It doesn't work; wrong use of python dictionary

[h4sh5]

Use of python dictionary here

CVE-2023-7028/CVE-2023-7028.py

Line 28 in c141972

paramsPost = {"user%5Bemail%5D":victim,"user%5Bemail%5D":attacker,"authenticity_token":token}

means only the attacker's email get sent; the exploit doesn't work.

Python dicts deduplicate keys automatically

[RegularITCat]

agreed