CVE-2024-8522 PoC — WordPress plugin LearnPress SQL注入漏洞

Source

https://github.com/realbotnet/CVE-2024-8522

Associated Vulnerability

Title:WordPress plugin LearnPress SQL注入漏洞 (CVE-2024-8522)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin LearnPress 4.2.7版本及之前版本存在SQL注入漏洞，该漏洞源于对用户提供的参数转义不足以及对现有SQL查询准备不足。攻击者利用该漏洞可以从数据库中提取敏感信息。

Description

POC Wordpress SQL Injection vulnerability  LearnPress REST API endpoint

Readme

# CVE-2024-8522 - Contact <a href="https://t.me/bl4ckhatx" target="_blank">@bl4ckhatx</a> Tool is available for purchase. 
POC Wordpress SQL Injection vulnerability  LearnPress REST API endpoint Contact:  <a href="https://t.me/bl4ckhatx" target="_blank">@bl4ckhatx</a>

# With SQJ Injection, a new admin user can be created and the target website can be access full system. 
Contact:  <a href="https://t.me/bl4ckhatx" target="_blank">@bl4ckhatx</a>
🚨🚨CVE-2024-8522 (CVSS: 10) : LearnPress - WordPress LMS Plugin Unauthenticated SQL Injection
⚠️The vulnerability resides in the LearnPress REST API endpoint, specifically in the handling of the ‘c_only_fields’ parameter. Insufficient escaping and inadequate preparation of SQL queries allow attackers to inject malicious SQL code.

ZoomEye Dork👉app:"WordPress LearnPress"
Contact:  <a href="https://t.me/bl4ckhatx" target="_blank">@bl4ckhatx</a>
https://www.zoomeye.hk/searchResult?q=app%3A%22WordPress%20LearnPress%22&from=5o6o54m5MjQwOTEyMDM=

File Snapshot


 [4.0K]  /data/pocs/9de3f0b13b7563c5a6af3a51604ed4308ff6f422
└── [1011]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!