CVE-2026-5115 PaperCut NG/MF 会话劫持漏洞

import requests # This script demonstrates checking for insecure communication headers. # It simulates an analyst verifying if the target exposes session cookies over HTTP. target_url = "http://<target-device-ip>/embedded/app" try: response = requests.get(target_url, timeout=5) headers = response.headers cookies = response.cookies print("[+] Target Response Headers:") for key, value in headers.items(): print(f"{key}: {value}") print("\n[+] Session Cookies Found:") for cookie in cookies: print(f"Name: {cookie.name}, Value: {cookie.value}, Secure: {cookie.secure}") if not cookies: print("[-] No cookies set, but check if body contains session tokens.") else: for cookie in cookies: if not cookie.secure: print(f"[!] VULNERABLE: Cookie '{cookie.name}' is not marked as Secure and transmitted over HTTP.") except Exception as e: print(f"[-] Error connecting to target: {e}")