CVE-2025-22783

This repository provides a working proof-of-concept (PoC) exploit for CVE-2025-22783, a time-based blind SQL injection vulnerability in the Squirrly SEO WordPress plugin (versions <= 12.4.01). The repository contains two files: a detailed README.md explaining the vulnerability, affected component, and exploitation steps, and a Python script (poc.py) that automates the exploitation process. The PoC script logs into a WordPress instance as an administrator, creates a Contributor-level user (if needed), then logs in as the Contributor and performs a time-based SQL injection attack against the vulnerable internal links management page. The script demonstrates extracting the database name by measuring response delays caused by the SLEEP() SQL function. The attack requires at least Contributor privileges on the target WordPress site. The endpoints targeted include the WordPress login page, user creation page, and the vulnerable admin page in the Squirrly SEO plugin. The exploit is operational and demonstrates real data extraction via SQL injection, but is not weaponized for broader or automated exploitation.