Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2021-24750 PoC — WordPress SQL注入漏洞

Source
Associated Vulnerability
Title:WordPress SQL注入漏洞 (CVE-2021-24750)
Description:WordPress是WordPress(Wordpress)基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress的WP Visitor Statistics (Real Time Traffic)插件 4.8之前版本存在SQL注入漏洞,该漏洞源于插件没有正确地清理和转义refDetails AJAX动作中的refUrl,攻击者可利用该漏洞执行SQL注入攻击.
Description
Demonstration of the WP Visitor Statistics plugin exploit
File Snapshot

[4.0K] /data/pocs/db13710683d12749f3f75aa7a9696a26f3e85d84 ├── [1.1K] docker-compose.yaml ├── [3.2K] exploit.py ├── [ 354] install-wp.sh ├── [ 452] readme.md └── [4.0K] wp-stats-manager ├── [4.0K] css │   ├── [ 33K] custom_admin.css │   ├── [5.1K] dashboard_widget.css │   ├── [ 12K] flags.min.css │   ├── [5.6K] jquery.jqplot.css │   ├── [ 31K] jquery-ui.css │   ├── [3.1K] modal.css │   ├── [8.3K] style.css │   └── [5.3K] style-review.css ├── [ 0] error_activation.txt ├── [4.0K] images │   ├── [ 741] arrow_rotate_anticlockwise.png │   ├── [ 705] calendar.png │   ├── [ 803] chart_line_add.png │   ├── [ 755] chart_line.png │   ├── [ 387] distance from left.txt │   ├── [1.5M] features.gif │   ├── [ 79K] flags.png │   ├── [ 43] ICO_1px.gif │   ├── [6.0K] icon-128x128.gif │   ├── [4.8K] icons.png │   ├── [ 526] mag.png │   ├── [ 45K] minichart-addon.png │   ├── [1.4K] network_wireless.png │   ├── [2.0K] online-blue.gif │   ├── [2.0K] online-red.gif │   ├── [ 503] page_white_copy.png │   ├── [8.9K] plogo.png │   ├── [ 12K] plogopro.png │   ├── [ 50K] poststats-addon.png │   ├── [1.5K] prohibition_button.png │   ├── [ 35K] search-engine.png │   ├── [ 35K] search-engines.png │   ├── [ 41K] stats_plugin.png │   ├── [ 30K] traffic.png │   ├── [ 30K] traffics.png │   ├── [ 179] ui-bg_flat_0_888888_40x100.png │   ├── [ 178] ui-bg_flat_75_ffffff_40x100.png │   ├── [ 120] ui-bg_glass_55_fbf9ee_1x400.png │   ├── [ 105] ui-bg_glass_65_ffffff_1x400.png │   ├── [ 111] ui-bg_glass_75_dadada_1x400.png │   ├── [ 110] ui-bg_glass_75_e6e6e6_1x400.png │   ├── [ 101] ui-bg_highlight-soft_75_cccccc_1x100.png │   ├── [4.3K] ui-icons_222222_256x240.png │   ├── [4.3K] ui-icons_454545_256x240.png │   └── [6.1K] upgrade-button-orange.png ├── [4.0K] includes │   ├── [ 66K] wsm_admin_interface.php │   ├── [ 26K] wsm_cron.php │   ├── [149K] wsm_db.php │   ├── [ 98K] wsm_functions.php │   ├── [137K] wsm_init.php │   ├── [2.9K] wsm_modal.php │   ├── [ 26K] wsm_requests.php │   ├── [ 34K] wsm_scheduled_mail.php │   ├── [ 16K] wsm_shortcodeTable.php │   └── [250K] wsm_statistics.php ├── [ 284] installation.txt ├── [4.0K] js │   ├── [ 22K] custom_admin.js │   ├── [ 41K] excanvas.js │   ├── [ 35K] jqplot.barRenderer.js │   ├── [8.0K] jqplot.canvasAxisLabelRenderer.js │   ├── [9.6K] jqplot.canvasAxisTickRenderer.js │   ├── [ 24K] jqplot.canvasTextRenderer.js │   ├── [ 28K] jqplot.categoryAxisRenderer.js │   ├── [ 45K] jqplot.cursor.js │   ├── [ 30K] jqplot.dateAxisRenderer.js │   ├── [ 13K] jqplot.enhancedLegendRenderer.js │   ├── [ 11K] jqplot.enhancedPieLegendRenderer.js │   ├── [ 21K] jqplot.highlighter.js │   ├── [ 21K] jqplot.logAxisRenderer.js │   ├── [2.0K] jqplot.mobile.js │   ├── [ 37K] jqplot.pieRendererjs.js │   ├── [459K] jquery.jqplot.js │   ├── [ 57K] json3.js │   └── [ 88K] wsm_new.js ├── [4.0K] languages │   ├── [ 14K] wp-stats-manager-de_DE_formal.mo │   ├── [ 35K] wp-stats-manager-de_DE_formal.po │   ├── [ 15K] wp-stats-manager-fr_FR.mo │   ├── [ 35K] wp-stats-manager-fr_FR.po │   ├── [ 29K] wp-stats-manager.pot │   ├── [ 18K] wp-stats-manager-ru_RU.mo │   └── [ 39K] wp-stats-manager-ru_RU.po ├── [ 3] log.txt ├── [5.3K] notifications.php ├── [1.7K] README.md ├── [6.8K] readme.txt └── [1.6K] wp-stats-manager.php 6 directories, 89 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.