CVE-2019-20361 PoC — WordPress Email Subscribers & Newsletters SQL注入漏洞

Source

https://github.com/jerrylewis9/CVE-2019-20361-EXPLOIT

Associated Vulnerability

Title:WordPress Email Subscribers & Newsletters SQL注入漏洞 (CVE-2019-20361)
Description:WordPress是WordPress基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。Email Subscribers & Newsletters是使用在其中的一个电子邮件订阅和新闻通讯插件。 WordPress Email Subscribers ＆ Newsletters 4.3.1之前版本中存在SQL注入漏洞。该漏洞源于基于数据库的应用缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令。

Description

There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).

Readme

# CVE-2019-20361-EXPLOIT
There was a flaw in the WordPress plugin, Email Subscribers &amp; Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).
This script is a "sanized-version" of original script avalible on exploit-db.com created by @KBA@SOGETI_ESEC
,the original version was sanized on RaidForums.com


![re4](https://user-images.githubusercontent.com/80862953/111556854-63d06780-8783-11eb-98f0-a4a6b48e98ec.png)


<h3>COMMAND</h3>

<p> > $ git clone https://github.com/jerrylewis9/CVE-2019-20361-EXPLOIT.git <br>
> $ cd CVE-2019-20361-EXPLOIT <br>
> $ chmod +x noodles.sh <br>
> $ bash noodles.sh "url"</p>


<h3>PREREQUISITE</h3>
        
**sqlmap** (https://github.com/sqlmapproject/sqlmap)


#The script recognize sqlmap, not sqlmap.py or similiar, so move sqlmap to bin directory.

File Snapshot


 [4.0K]  /data/pocs/e93175b2d2507fb88e443722e9f06bf11c19b38e
├── [7.1K]  noodles.sh
└── [ 883]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!