kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition Vulnerability

2024-03-0500:00:00

Mohammad Reza Omrani

0day.today

127

wordpress

vulnerability

rating tampering

turbo intruder

race condition

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.8%

JSON

# Exploit Title: kk Star Ratings < 5.4.6 - Rating Tampering via Race
Condition
# Google Dork: inurl:/wp-content/plugins/kk-star-ratings/
# Exploit Author: Mohammad Reza Omrani
# Vendor Homepage: https://github.com/kamalkhan
# Software Link: https://wordpress.org/plugins/kk-star-ratings/
# WPScan :
https://wpscan.com/vulnerability/6f481d34-6feb-4af2-914c-1f3288f69207/
# Version: 5.4.6
# Tested on: Wordpress 6.2.2
# CVE : CVE-2023-4642

# POC:
1- Install and activate kk Star Ratings.
2- Go to the page that displays the star rating.
3- Using Burp and the Turbo Intruder extension, intercept the rating
submission.
4- Send the request to Turbo Intruder using Action > Extensions > Turbo
Intruder > Send to turbo intruder.
5- Drop the initial request and turn Intercept off.
6- In the Turbo Intruder window, add "%s" to the end of the connection
header (e.g. "Connection: close %s").
7- Use the code `examples/race.py`.
8- Click "Attack" at the bottom of the window. This will send multiple
requests to the server at the same moment.
9- To see the updated total rates, reload the page you tested.