tghook/cve-2024-4295-pocCVE-2024-4295 Email Subscribers by Icegram Express <= 5.7.20 - Injeção SQL Não Autenticada via hash
CVE-2024-4295 Inscritores de Email por Icegram Express <= 5.7.20 - Injeção SQL não autenticada através de hash
Pilha de Chamadas
ES_DB_Lists_Contacts->edit_subscriber_status (\email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616)
Email_Subscribers_Public->es_email_subscribe_init (\email-subscribers\lite\public\class-email-subscribers-public.php:178)
WP_Hook->apply_filters (\var\www\html\wp-includes\class-wp-hook.php:324)
WP_Hook->do_action (\var\www\html\wp-includes\class-wp-hook.php:348)
do_action (\var\www\html\wp-includes\plugin.php:517)
require_once (\var\www\html\wp-settings.php:695)
require_once (\var\www\html\wp-config.php:133)
require_once (\var\www\html\wp-load.php:50)
require (\var\www\html\wp-blog-header.php:13)
{main} (\var\www\html\index.php:17)
Arquivo: email-subscribers/lite/public/class-email-subscribers-public.php
image
image
Arquivo: email-subscribers/lite/includes/db/class-es-db-lists-contacts.php
image
PoC:
Inscrição por Email image
Verificar email
image
Exemplo de link:
http://192.168.110.184:8080/?es=optin&hash=eyJtZXNzYWdlX2lkIjowLCJjYW1wYWlnbl9pZCI6MCwiY29udGFjdF9pZCI6IjMiLCJlbWFpbCI6Imt1cDU4MjQzQGlsZWJpLmNvbSIsImd1aWQiOiJiYXNvd3otZnpjYWRqLXN6ZmxycS1qY2ViYWYtdXpxYm12IiwibGlzdF9pZHMiOlsiMiJdLCJhY3Rpb24iOiJzdWJzY3JpYmUifQ==
image
Exemplo de hash:
eyJtZXNzYWdlX2lkIjowLCJjYW1wYWlnbl9pZCI6MCwiY29udGFjdF9pZCI6IjMiLCJlbWFpbCI6Imt1cDU4MjQzQGlsZWJpLmNvbSIsImd1aWQiOiJiYXNvd3otZnpjYWRqLXN6ZmxycS1qY2ViYWYtdXpxYm12IiwibGlzdF9pZHMiOlsiMiJdLCJhY3Rpb24iOiJzdWJzY3JpYmUifQ==
Decodificar valor base64 do parâmetro hash: image