## https://sploitus.com/exploit?id=F4D67FF6-BDC2-572F-BDC2-894AD2035D0B
# CVE-2025-7441
StoryChief - 1.0.42 - Unauthenticated Arbitrary File Upload
## Important notice
This repository contains a proof-of-concept (PoC) client script named `CVE-2025-7441.py`.
**This tool is provided for defensive research, education, and authorized testing only.** Do not run this script against systems you do not own or do not have explicit written permission to test. Unauthorized use is illegal and unethical.
---
## Overview
`CVE-2025-7441.py` is a simple PoC client that demonstrates an exploitation pattern for CVE-2025-7441: an unauthenticated arbitrary file upload / server-side fetch behavior reported against certain StoryChief WordPress plugin versions. The script constructs and sends a webhook-style JSON payload to the plugin endpoint and then checks a common WordPress uploads path to determine whether the remote resource was saved by the target.
The script uses a default remote file URL (a raw file hosted on GitHub). It does not accept a remote file URL as a command-line argument.
---
## What the script does (high level)
1. Builds a JSON payload that places a remote file URL at:
data.featured_image.data.sizes.full
2. Computes an HMAC-SHA256 value over the JSON payload (the script uses an empty key) and stores it as `meta.mac` in the payload.
3. Sends an HTTP POST to:
/wp-json/storychief/webhook
with `Content-Type: application/json`.
4. After POSTing, the script checks if the file appears at:
/wp-content/uploads///
where `` and `` are the current year and month and `` is the filename portion of the default remote URL.
5. If the file is reachable (HTTP 200), the script prints the upload path. If not, it prints ``.
The script prints a computed HMAC value before sending and uses `verify=False` for HTTP requests by default.
---
## Usage
### Requirements
- Python 3.6+
- Python package: `requests` (install with `pip install requests`)
### Basic usage
```bash
python3 CVE-2025-7441.py
Example:
python3 CVE-2025-7441.py https://target.example/
Notes:
The script expects exactly one argument: the base site URL (with scheme). It will append /wp-json/storychief/webhook.
The script uses an internal default file_url:
https://raw.githubusercontent.com/Pwdnx1337/ZIP/refs/heads/main/ZIP.php
(this can be modified in the script if you control your own test file).
The script disables TLS verification in requests (verify=False) to ease local testing. For production testing or sensitive environments, re-enable verification.
---
Output examples
Successful detection (example):
[+] computed hmac:
[+] success! [+]
file uploaded in : https://target.example/wp-content/uploads/2025/10/ZIP.php
Alternate successful message (script branch):
[+] computed hmac:
[+] success! [+]
backdoor uploaded in : https://target.example/wp-content/uploads/2025/10/ZIP.php
Failure:
[+] computed hmac:
The script will print for network errors, non-200 responses from the upload path check, or other errors encountered during execution.
---
Limitations and caveats
No file-url CLI option: This script uses the embedded default remote file URL. If you need to test with a different payload, edit the DEFAULT_FILE_URL constant in the script.
No guarantee of RCE: The script only checks whether the remote resource was stored at the expected uploads path. It does not execute or validate code execution. Whether an uploaded file results in code execution depends on the target server configuration, PHP handling, and upload directory execution settings.
Timing and async processing: If the plugin queues or defers processing, the upload may not be immediately visible. The script performs a single verification check after POST; adjust the script if you need retries or delays.
HMAC behavior: The script computes an HMAC using an empty key (this mirrors a simple PoC behavior). If a target enforces a valid MAC key, the request will be rejected.
Network reachability: If the target cannot reach the default remote file URL (eg. egress blocked), the fetch will fail.
Ethics / legality: Always test within controlled, authorized environments.
---
Detection and indicators of compromise (IoC)
Unexpected POST requests to:
/wp-json/storychief/webhook
originating from unknown IPs.
Server-side outbound GET requests to attacker-controlled domains coinciding with webhook POSTs.
Newly created files in:
wp-content/uploads///
with suspicious extensions (e.g., .php) or image files containing non-image content.
Access logs showing immediate external visits to newly uploaded files.
---
Mitigation and remediation
Short-term (quick actions)
Update StoryChief and any related plugins to the latest patched versions.
Block or restrict access to the webhook endpoint via firewall/WAF if the endpoint is not required.
Restrict server outbound HTTP(S) access to untrusted domains where feasible.
Developer-level (long-term)
Do not perform server-side fetches of attacker-controlled URLs without strict validation (whitelist trusted hosts only).
Validate downloaded file content (MIME type, expected format) and reject disallowed file types.
Store uploaded or fetched resources outside the webroot or ensure upload directories do not permit script execution. Example Apache directive to disable PHP in uploads:
php_admin_flag engine Off
Options -ExecCGI
Require authenticated webhooks and verify HMAC signatures; reject requests with invalid or missing signatures.
Implement monitoring to detect unexpected outbound requests and suspicious uploaded files.
If a compromise is suspected:
Isolate the host, preserve logs and filesystem snapshots, search for web shells/backdoors, rotate credentials, and restore from a known-good backup.
---
License & attribution
This PoC script is for defensive research and education. Use responsibly.
License: choose an appropriate license (for example, MIT).
Attribution: include any credit you wish to show (author, discoverer). If using this for disclosure, follow coordinated disclosure best practices.
---
Final note
Use this script only in environments you control or where you have explicit written permission to test. If you intend to publish a demonstration (for example, on video), include visible proof that the test is performed on an isolated lab (localhost, VM, or container) to avoid encouraging misuse.