CVE-2025-71282 XenForo 路径泄露漏洞

import requests def check_path_disclosure(url): """ Check if the target XenForo instance leaks file paths via open_basedir errors. """ # Common paths or endpoints that might trigger file operations # In a real scenario, specific vulnerable endpoints would be targeted. # Here we simulate a request that might trigger an error. # Example: Trying to access a file that is likely restricted by open_basedir # or triggering a debug mode error. try: response = requests.get(url, timeout=10) # Patterns indicating file paths (Linux and Windows) if "Path Disclosure" in response.text or "/var/www/" in response.text or \ "C:\\\\inetpub\\" in response.text or "Warning:" in response.text: print("[+] Potential Path Disclosure Detected!") print(f"URL: {url}") print("Snippet:") # Extract a snippet containing the path lines = response.text.split('\n') for line in lines: if '/' in line and ('www' in line or 'html' in line or 'var' in line): print(line.strip()) break else: print("[-] No path disclosure detected via simple GET.") except requests.RequestException as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": target = "http://example.com/" # Replace with actual target check_path_disclosure(target)