JOIN BREACHFORUMS NEW TELEGRAM
Dokan Pro Unauthenticated SQL Injection POC | CVSS 10
by Loki - Monday July 8, 2024 at 02:16 PM
The God of Stories
Member
Posts: 2,886
Threads: 65
Joined: Jun 2024
Reputation: 1,788

Active
#1
Jul 08, 2024, 02:16 PM
The Dokan Pro plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter in all versions up to, and including, 3.10.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

POC:
Hidden Content
You must register or login to view this content.

Omnicer
Reply
Breached
Member
Posts: 28
Threads: 4
Joined: Jun 2024
Reputation: 0
#2
Jul 08, 2024, 02:19 PM
Thank you, I will try it
Reply
Uber User

Posts: 331
Threads: 13
Joined: Mar 2024
Reputation: 29
#3
Jul 08, 2024, 02:24 PM
Learning SQL for ethical purpose
Reply
Encrypted Content Curator
God
Posts: 45
Threads: 9
Joined: Apr 2024
Reputation: 762

GOD
#4
Jul 08, 2024, 02:34 PM
inurl:/wp-content/plugins/dokan-pro

intitle:"Dokan Pro" inurl:/wp-content/plugins
[Image: facebook.jpg]
Website
Reply
The God of Stories
Member
Posts: 2,886
Threads: 65
Joined: Jun 2024
Reputation: 1,788

Active
#5
Jul 08, 2024, 03:01 PM (This post was last modified: Jul 08, 2024, 03:04 PM by Loki.)
(Jul 08, 2024, 02:34 PM)DoingFedTime Wrote: inurl:/wp-content/plugins/dokan-pro

intitle:"Dokan Pro" inurl:/wp-content/plugins

good ol' google dorks!

OR

we can use censys search with something like

"dokan pro" and labels= `wordpress`

and fetch all the servers that are using that plugin.

then sort by the last modified date to weed out the patched servers.
Reply
Encrypted Content Curator
God
Posts: 45
Threads: 9
Joined: Apr 2024
Reputation: 762

GOD
#6
Jul 08, 2024, 03:41 PM
@Lokie Yes, thank you for passively pointing out that I'm old hahahahahhahaha
This and Shodan as well; I'm just old school. Smile
[Image: facebook.jpg]
Website
Reply
The God of Stories
Member
Posts: 2,886
Threads: 65
Joined: Jun 2024
Reputation: 1,788

Active
#7
Jul 08, 2024, 04:06 PM
@DoingFedTime tbh when everything fails, google dorks win
Reply
VIP User
VIP
Posts: 62
Threads: 26
Joined: Jul 2024
Reputation: 50
#8
Jul 09, 2024, 05:15 AM
Need this for education
Reply
Breached
Member
Posts: 6
Threads: 0
Joined: Jan 2024
Reputation: 0
#9
Jul 09, 2024, 08:01 AM
thank you sql injection best attack thx
Reply
Breached
Member
Posts: 3
Threads: 0
Joined: Jul 2024
Reputation: 0
#10
Jul 16, 2024, 02:12 AM
I will try it now
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  POC CVE-2025-24071 caca28sapo1 17 1,223 4 hours ago
Last Post: Test689
  New Zer0 Day Wordpress A3g00n 83 4,233 May 11, 2026, 08:17 PM
Last Post: j4ng0
  {SECRET} DATABASE OF EXPLOITS lulagain 441 28,188 May 11, 2026, 05:41 PM
Last Post: chiki
  Google Dorks for finding SQL injection vulnerabilities and other security issues 1yush 69 3,773 May 11, 2026, 03:55 PM
Last Post: fkmonkey
  CVE-2024-32002 RCE PoC HA_twck 2 585 May 11, 2026, 01:33 PM
Last Post: newxiao1

Forum Jump:


 Users browsing this forum: