CVE-2025-2011 - Depicter Plugin SQL Injection Vulnerability

CVE Reference: CVE-2025-2011

This repository contains a proof-of-concept environment for testing the SQL injection vulnerability in Depicter Slider & Popup Builder plugin (versions < 3.6.2).

Prerequisites

• Docker
• Docker Compose
• Python 3.x
• Required Python packages: requests, colorama

Setup Instructions

1. Start the Environment

   root@kitploit:~

   docker-compose up -d
   

2. Complete WordPress Installation

   • Open your browser and navigate to http://localhost:5555
   • Follow the WordPress installation wizard:
     • Select your language
     • Set up your site title
     • Create an admin account
     • Complete the installation

3. Install the Vulnerable Plugin

   root@kitploit:~

   chmod +x install-plugin.sh
   ./install-plugin.sh
   

   This script will:

   • Install WP-CLI in the container
   • Download and install Depicter plugin v3.6.1
   • Activate the plugin

4. Install Python Dependencies

   root@kitploit:~

   pip install requests colorama
   

Testing the Vulnerability

The PoC script (poc.py) can be used to test the vulnerability in different modes:

1. Check if target is vulnerable

   root@kitploit:~

   python poc.py -u http://localhost:5555
   

2. Extract admin details

   root@kitploit:~

   python poc.py -u http://localhost:5555 -m admin
   

3. Execute custom SQL query

   root@kitploit:~

   python poc.py -u http://localhost:5555 -m custom -q "SELECT VERSION()"
   

4. Enable debug output

   root@kitploit:~

   python poc.py -u http://localhost:5555 -d
   

Environment Details

• WordPress: Latest version
• Depicter Plugin: v3.6.1 (vulnerable version)
• MySQL: 5.7
• PHP: Latest version (from WordPress image)

Cleanup

To stop and remove the environment:

docker-compose down -v

Disclaimer

This environment is provided for educational and testing purposes only. Do not use this against any systems without explicit permission.