# N/A
# 漏洞描述
## 概述
Email Subscribers by Icegram Express插件存在SQL注入漏洞，该漏洞通过`IG_ES_Subscribers_Query`类中的`run`函数利用用户提供的参数未充分转义和现有SQL查询准备不足导致。
## 影响版本
所有版本直到包括5.7.14
## 细节
漏洞存在于`IG_ES_Subscribers_Query`类中的`run`函数，由于用户提供的参数未充分转义，且现有SQL查询准备不足，导致攻击者能够向已存在的查询中附加额外的SQL查询。
## 影响
未认证的攻击者可以利用此漏洞从数据库中提取敏感信息。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | POC for SQLi vulnerability in Icegram express | https://github.com/c0d3zilla/CVE-2024-2876 | POC详情 |
| 2 | None | https://github.com/Quantum-Hacker/CVE-2024-2876 | POC详情 |
| 3 | None | https://github.com/0xAgun/CVE-2024-2876 | POC详情 |
| 4 | None | https://github.com/skyrowalker/CVE-2024-2876 | POC详情 |
| 5 | WP-SQL-Injection CVE-2024-2876 AND 2024-CVE-2024-3495 | https://github.com/issamiso/CVE-2024-2876 | POC详情 |
| 6 | WP-SQL-Injection CVE-2024-2876 AND 2024-CVE-2024-3495 | https://github.com/issamjr/CVE-2024-2876 | POC详情 |
| 7 | None | https://github.com/0xlf/CVE-2024-2876 | POC详情 |
| 8 | The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2876.yaml | POC详情 |
| 9 | None | https://github.com/zxcod3/CVE-2024-2876 | POC详情 |
| 10 | None | https://github.com/chsxthwik/CVE-2024-2876 | POC详情 |
| 11 | None | https://github.com/0zerobyte/CVE-2024-2876 | POC详情 |
| 12 | None | https://github.com/voidbroker/CVE-2024-2876 | POC详情 |
暂无评论