关联漏洞
标题：Fortinet FortiWeb 安全漏洞 (CVE-2025-64446)描述：Fortinet FortiWeb是美国飞塔（Fortinet）公司的一款Web应用层防火墙，它能够阻断如跨站点脚本、SQL注入、Cookie中毒、schema中毒等攻击的威胁，保证Web应用程序的安全性并保护敏感的数据库内容。 Fortinet FortiWeb 8.0.0版本至8.0.1版本、7.6.0版本至7.6.4版本、7.4.0版本至7.4.9版本、7.2.0版本至7.2.11版本和7.0.0版本至7.0.11版本存在安全漏洞，该漏洞源于相对路径遍历，可能导致执行管理命令。
介绍
# CVE-2025-64446 Exploit Tool
Exploit tool for CVE-2025-64446 vulnerability verification and exploitation in FortiWeb devices.
## Description
This tool tests for and exploits a path traversal vulnerability (CVE-2025-64446) in FortiWeb web application firewalls. It can be used to verify vulnerability status or exploit the CGI endpoint to create/modify user accounts.
## Installation
```bash
pip install -r requirements.txt
```
## Usage
### Vulnerability Verification (Read-only)
```bash
python3 exploit.py -t <target_ip> --check
```
### Execute Exploit
```bash
python3 exploit.py -t <target_ip> --exploit
```
### Custom Parameters
```bash
python3 exploit.py -t <target_ip> --exploit --username sxy --password sxyrxyadmin1!
```
### Multiple Targets from File
```bash
python3 exploit.py -l targets.txt --check
```
Create a `targets.txt` file with one IP address per line:
```
192.168.1.100
192.168.1.101
192.168.1.102
```
## Options
- `-t, --target` - Target IP address (required if `--targets-file` not used)
- `-l, --targets-file` - File containing target IP addresses (one per line, required if `--target` not used)
- `-p, --port` - Target port (default: 443)
- `--http` - Use HTTP instead of HTTPS
- `--check` - Vulnerability verification only (read-only)
- `--exploit` - Execute CGI endpoint exploit
- `--username` - Username for exploit (default: sxy)
- `--password` - Password to set (default: sxyrxyadmin1!)
- `--profname` - Profile name (default: prof_admin)
- `--vdom` - VDOM name (default: root)
- `--loginname` - Login name (default: admin)
- `--testpoint-name` - Testpoint/user name to create (default: Testpoint)
## Disclaimer
This tool is for authorized security research and educational purposes only. Only use on systems you own or have explicit permission to test.
文件快照
[4.0K] /data/pocs/3cb3bd34eeaf7f9671758e7feb30e892a48128f7
├── [ 16K] exploit.py
├── [1.8K] README.md
└── [ 33] requirements.txt
1 directory, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。