{"id":796,"date":"2025-04-21T01:34:59","date_gmt":"2025-04-21T01:34:59","guid":{"rendered":"http:\/\/localhost\/?p=796"},"modified":"2025-04-21T01:34:59","modified_gmt":"2025-04-21T01:34:59","slug":"exploit-for-cve-2025-3102","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=796","title":{"rendered":"Exploit for CVE-2025-3102"},"content":{"rendered":"
\n

Vulnerability Details<\/h2>\n
\n

Basic Information<\/h3>\n\n\n\n\n\n\n
Title<\/th>\nExploit for CVE-2025-3102<\/td>\n<\/tr>\n
Type<\/th>\ngithubexploit<\/td>\n<\/tr>\n
Published<\/th>\n2025-04-20T13:59:57<\/td>\n<\/tr>\n
Last Seen<\/th>\n2025-04-21T06:03:59<\/td>\n<\/tr>\n
CVSS Score<\/th>\n8.1 (HIGH)<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVSS v3 Details<\/h3>\n\n\n\n\n\n\n\n\n\n
Attack Vector<\/th>\nNETWORK<\/td>\n<\/tr>\n
Attack Complexity<\/th>\nHIGH<\/td>\n<\/tr>\n
Privileges Required<\/th>\nNONE<\/td>\n<\/tr>\n
User Interaction<\/th>\nNONE<\/td>\n<\/tr>\n
Scope<\/th>\nUNCHANGED<\/td>\n<\/tr>\n
Confidentiality Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Integrity Impact<\/th>\nHIGH<\/td>\n<\/tr>\n
Availability Impact<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

CVE Information<\/h3>\n\n\n\n\n
CVE IDs<\/th>\nCVE-2025-3102<\/td>\n<\/tr>\n
CWE<\/th>\n<\/td>\n<\/tr>\n
Bulletin Family<\/th>\nexploit<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

Description<\/h3>\n
\n # CVE-2025-3102
\n\ud83d\udee0\ufe0f SureTriggers Exploit Script
\nScript ini digunakan untuk mengidentifikasi dan mengeksploitasi celah keamanan pada plugin SureTriggers di situs WordPress yang menggunakan versi rentan (\u2264 v1.0.78). Jika berhasil, script akan membuat akun admin WordPress secara otomatis.<\/p>\n

\u2699\ufe0f Fitur
\nDeteksi versi plugin SureTriggers<\/p>\n

Validasi halaman login WordPress (wp-login.php)<\/p>\n

Eksekusi exploit via endpoint REST API<\/p>\n

Pembuatan user admin WordPress jika target rentan<\/p>\n

Simpan hasil ke file vulnerable.txt<\/p>\n

Multi-threading untuk percepatan proses<\/p>\n

Penggunaan User-Agent acak<\/p>\n

\ud83d\ude80 Cara Penggunaan
\n\ud83d\udce6 Persiapan
\nInstall dependencies (jika belum):<\/p>\n

bash
\nCopy
\nEdit
\npip install requests
\nSiapkan file berisi daftar URL target (satu per baris), misalnya targets.txt:<\/p>\n

arduino
\nCopy
\nEdit
\nhttp:\/\/example1.com
\nhttps:\/\/example2.net
\n…
\n\ud83e\uddea Eksekusi
\nbash
\nCopy
\nEdit
\npython exploit.py -l targets.txt -t 10
\n\ud83d\udd27 Opsi CLI<\/p>\n

Opsi\tDeskripsi
\n-l, –target_urls\tFile teks berisi daftar target
\n-t, –threads\tJumlah thread (default: 5)
\n\u2705 Contoh Output
\nless
\nCopy
\nEdit
\n[+] http:\/\/example.com – Vulnerable v1.0.75 detected.
\n[+] http:\/\/example.com – Exploit successful! username:password
\n[+] http:\/\/example.com\/wp-login.php | username:password (saved)
\n\ud83d\udcdd Catatan
\nTarget hanya dieksploitasi jika:<\/p>\n

Plugin SureTriggers ditemukan<\/p>\n

Versi plugin \u2264 1.0.78<\/p>\n

Halaman wp-login.php valid<\/p>\n

File vulnerable.txt akan berisi akun yang berhasil dibuat dalam format:<\/p>\n

pgsql
\nCopy
\nEdit
\nhttp:\/\/target.com\/wp-login.php | username:password
\n\u26a0\ufe0f Disclaimer
\nScript ini dibuat untuk tujuan edukasi dan pengujian keamanan yang sah. Dilarang keras digunakan untuk kegiatan yang melanggar hukum atau tanpa izin dari pemilik sistem. Penulis tidak bertanggung jawab atas penyalahgunaan script ini.<\/p>\n

****<\/p><\/div>\n<\/p><\/div>\n

\n

Impact Assessment<\/h3>\n\n\n\n
Base Score<\/th>\n8.1<\/td>\n<\/tr>\n
Severity<\/th>\nHIGH<\/td>\n<\/tr>\n<\/table><\/div>\n
\n

View full CVE details<\/a><\/p>\n<\/p><\/div>\n<\/div>\n