CVE-2021-32789 PoC — Arbitrary SQL (SQL injection) possible via the Store API component.

Source

Associated Vulnerability

Description

Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions >= 2.5.0

Readme

# CVE-2021-32789
Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions >= 2.5.0

# Install
```
git clone https://github.com/DonVorrin/CVE-2021-32789.git
cd CVE-2021-32789
sudo pip install -r requirements.txt
```

# Exploit
```
python3 exploit.py
Enter URL: (Example: http://exploit.cve/)

Enter number:
  1 - Output tables                               |
  2 - Output tables + columns                     |
  3 - Output text (need use number tabels)      <- 

The output of a single line from the database is done for convenience.
I recommend to use Web version, generate payload independently.
(See ------FOR BROWSER URL------)
```

File Snapshot

 [4.0K]  /data/pocs/5ad033fc2c98d89d386610ccc126acd04c96966d
├── [4.3K]  exploit.py
├── [ 652]  README.md
└── [   8]  requirements.txt

0 directories, 3 files

Remarks