Poc for Unauthenticated Admin Session Hijack - Pie Register Plugin (≤ 3.7.1.4)<p align="center">
<a href="https://wordpress.org">
<img src="https://upload.wikimedia.org/wikipedia/commons/9/98/WordPress_blue_logo.svg" width="100" alt="WordPress Logo">
</a>
</p>
<h1 align="center">CVE-2025-34077</h1>
<p align="center"><b>Unauthenticated Admin Session Hijack - Pie Register Plugin (≤ 3.7.1.4)</b></p>
---
## 📌 Description
This exploit targets a vulnerability in the **Pie Register WordPress plugin** (versions ≤ 3.7.1.4), allowing **unauthenticated session hijacking of admin accounts**.
> 🛡️ **This tool is for authorized testing and research only. Do not use it on systems you do not own or have explicit permission to test.**
---
## 🧪 Proof of Concept
<p align="center">
<img src="poc-success.png" width="700" alt="PoC Screenshot" />
</p>
---
## 🚀 Usage
```bash
python3 CVE-2025-34077.py http://target.site
````
### Example:
```bash
python3 CVE-2025-34077.py http://example.com
```
---
## ✅ Features
* Sends crafted POST payload to target site
* Extracts valid `Set-Cookie` values from unauthenticated response
* Confirms exploit success with cookie details
* Works with tools like Burp Suite or browser dev tools
---
## 🧠 Technical Details
* **Vulnerability Type:** Auth Bypass / Session Hijack
* **Plugin:** Pie Register for WordPress
* **Affected Versions:** ≤ 3.7.1.4
* **Vector:** Crafted POST request to login endpoint
* **Impact:** Attacker gains administrator-level access via hijacked cookies
---
## ⚠️ Disclaimer
This script is provided for:
* Educational purposes
* Authorized penetration testing
* Security research
**You are fully responsible** for any misuse. Unauthorized use of this tool may violate laws.
---
## 👤 Author
* **Handle:** 0xgh057r3c0n
* **GitHub:** [github.com/0xgh057r3c0n/CVE-2025-34077](https://github.com/0xgh057r3c0n/CVE-2025-34077)
---
## 📄 License
This project is licensed under the [MIT License](https://github.com/0xgh057r3c0n/CVE-2025-34077/blob/main/LICENSE).
登录后查看神龙缓存的 POC 文件快照
登录查看