Description
该漏洞存在于WordPress插件NotificationX的/wp-json/notificationx/v1/analytics接口中，允许攻击者通过SQL注入操纵数据库查询。这可能导致敏感数据泄露、数据篡改或数据库破坏等严重后果。
WordPress Plugin NotificationX /wp-json/notificationx/v1/analytics SQL 注入漏洞 （CVE-2024-1698）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-1698
https://www.wordfence.com/threat-intel/vulnerabilities/id/e110ea99-e2fa-4558-bcf3-942a35af0b91
https://www.vicarius.io/vsociety/posts/decoding-the-unseen-threat-exploiting-cve-2024-1698-unauthenticated-sql-injection-in-notificationx-wordpress-plugin-from-basics-to-breach-a-comprehensive-guide-to-source-code-analysis-and-crafting-the-ultimate-exploit
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1698.yaml
https://lmboke.com/archives/cve-2024-1698
https://cn-sec.com/archives/2710136.html
https://cve.imfht.com/poc_detail/4da2aa162bd10492bd84d7a474dad79d7a1b48b7
https://ethicalhacking.uk/sql-injection-alert-dissecting-cve-2024-1698-in-notificationx-for-wordpress/
https://www.sentinelone.com/vulnerability-database/cve-2024-1698/