PT-2024-4064 · Icegram Express · Email Subscribers

1337_Wannabe + 1 · Published 2024-06-04 · Updated 2024-06-11 · CVE-2024-4295

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express plugin for WordPress versions up to, and including, 5.7.20

Description: The issue is related to insufficient escaping on the user-supplied hash parameter and lack of sufficient preparation on the existing SQL query, making it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. With over 90,000 active installations, the potential impact of this bug is significant.

Recommendations: For versions up to, and including, 5.7.20, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the hash parameter to minimize the risk of exploitation. Avoid using the hash parameter in existing SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-04510

CVE-2024-4295

Affected Products

Email Subscribers

References · 15

• 🔥 https://github.com/truonghuuphuc/CVE-2024-4295-Poc · Exploit
• https://plugins.trac.wordpress.org/changeset/3090845/email-subscribers/trunk/lite/includes/db/class-es-db-lists-contacts.php · Patch
• https://osv.dev/vulnerability/CVE-2024-4295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4295 · Security Note
• https://bdu.fstec.ru/vul/2024-04510 · Security Note
• https://twitter.com/fofabot/status/1798533312421728605 · Twitter Post
• https://twitter.com/moton/status/1798730716613870041 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/641123af-1ec6-4549-a58c-0a08b4678f45?source=cve · Note
• https://twitter.com/the_yellow_fall/status/1798520108274581594 · Twitter Post
• https://wordpress.org/plugins/email-subscribers · Note
• https://wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/email-subscribers/email-subscribers-by-icegram-express-5720-unauthenticated-sql-injection-via-hash · Note
• https://twitter.com/fridaysecurity/status/1798520908711346652 · Twitter Post
• https://t.me/pentestingnews/47793 · Telegram Post
• https://twitter.com/Dinosn/status/1798568313561428100 · Twitter Post
• https://t.me/cvenotify/82855 · Telegram Post