WatuPRO Plugin up to 5.5.3.6 on WordPress wp-admin/admin-ajax.php watupro_questions sql injection

Summaryinfo

A vulnerability was found in WatuPRO Plugin up to 5.5.3.6 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file wp-admin/admin-ajax.php. The manipulation of the argument watupro_questions as part of Parameter results in sql injection. This vulnerability is cataloged as CVE-2017-9834. The attack may be launched remotely. Furthermore, there is an exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in WatuPRO Plugin up to 5.5.3.6 on WordPress (WordPress Plugin). Affected is an unknown code of the file wp-admin/admin-ajax.php. The manipulation of the argument watupro_questions as part of a Parameter leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

The bug was discovered 06/23/2017. The weakness was shared 09/07/2017 as EDB-ID 42291 as not defined exploit (Exploit-DB). The advisory is available at exploit-db.com. This vulnerability is traded as CVE-2017-9834 since 06/23/2017. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 76 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:wp-admin/admin-ajax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.3.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (42291). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• WatuPRO Plugin

Version

• 5.5.3.0
• 5.5.3.1
• 5.5.3.2
• 5.5.3.3
• 5.5.3.4
• 5.5.3.5
• 5.5.3.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion