mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
54 lines
2.4 KiB
YAML
54 lines
2.4 KiB
YAML
id: CVE-2021-24295
|
|
|
|
info:
|
|
name: Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection
|
|
author: DhiyaneshDK
|
|
severity: high
|
|
description: |
|
|
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
|
|
impact: |
|
|
Unauthenticated attackers can extract database contents via time-based blind SQL injection through User-Agent header manipulation, potentially exposing all WordPress user data.
|
|
remediation: Fixed in 5.153.4
|
|
reference:
|
|
- https://wpscan.com/vulnerability/152171fc-888c-4275-a118-5a1e664ef28b
|
|
- https://github.com/20142995/nuclei-templates
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2021-24295
|
|
cwe-id: CWE-89
|
|
epss-score: 0.26068
|
|
epss-percentile: 0.96117
|
|
cpe: cpe:2.3:a:cleantalk:spam_protection\,_antispam\,_firewall:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: cleantalk
|
|
product: spam_protection\,_antispam\,_firewall
|
|
framework: wordpress
|
|
fofa-query: body="/plugin/cleantalk-spam-protect/"
|
|
tags: cve,cve2021,wpscan,wordpress,wp,wp-plugin,cleantalk-spam-protect,sqli,passive,vkev,vuln
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /wp-content/plugins/cleantalk-spam-protect/readme.txt HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'compare_versions(version, "< 5.153.4")'
|
|
- 'contains(body, "Spam protection")'
|
|
- 'status_code == 200'
|
|
condition: and
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: version
|
|
part: body
|
|
group: 1
|
|
internal: true
|
|
regex:
|
|
- "(?mi)Stable tag: ([0-9.]+)"
|
|
# digest: 4a0a004730450220162442d7d4ac205fada10cfc6d29708e494c5c39e7f3b675f921d3df563fa046022100d9b1ce5d193c3def5ce2ebe932e8fc0f0ceede1455591d09ace8bb469cfdffe8:922c64590222798bb761d5b6d8e72950 |