CVE-2024-1698

CRITICALNuclei

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-1698 has a selected CVSS score of 9.8 (critical); EIP currently links 3 repository PoCs, 1 Nuclei template, and 1 lab environment.

Description

The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 29, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
3
Nuclei templates
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 23, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

NotificationX for WordPress

Browse NotificationX / NotificationX for WordPress
VulnCheckVersion data not supplied

notificationx

Browse wpdeveloper / notificationx

Default status: unknown

CVE ListThrough 2.8.2affected

NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

Browse wpdevteam / NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar

Default status: unaffected

CVE ListThrough 2.8.2affected

Proofs of concept

3

Repository PoCs

GitHubDhananjayasj/CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-ExtractionRepository PoCby Dhananjayasj0Exploit2 files

4.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs unauthenticated time-based blind SQL injection against the NotificationX WordPress plugin to extract the admin username and password hash.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2024-1698. The script performs a time-based blind SQL injection against a hardcoded target URL to extract the admin username and password hash from a WordPress database. All behavior is consistent with the stated purpose of demonstrating the SQL injection vulnerability. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm were observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareNotificationX WordPress Plugin
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (exploit.py) that actively exploits CVE-2024-1698 by sending crafted HTTP requests to extract sensitive data from a vulnerable target. The README describes it as an exploit and provides usage instructions.

exploit.py:1-71README.md:7

Requirements

  • Target WordPress site with NotificationX plugin version <= 2.8.2README.md:13
  • Python 3.6+ with requests libraryREADME.md:38-39

Observed behavior

  • Sends POST requests to /wp-json/notificationx/v1/analytics with a malicious 'type' parameter containing a time-based blind SQL injection payloadexploit.py:19-22
  • Determines admin username length by injecting IF(LENGTH(...)=N, SLEEP(delay), null) and measuring response timeexploit.py:18-29
  • Extracts admin username character by character using ASCII(SUBSTRING(...)) with SLEEP-based timingexploit.py:32-49
  • Extracts admin password hash using the same time-based blind technique on the user_pass columnexploit.py:52-71
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Target Url
Payload withheldThe exploit script targets a local/private IP address, indicating it is intended for a controlled test environment rather than a live attack.exploit.py:9
Sql Injection Payload
Payload withheldThe payload extracts the admin username length via time-based blind SQL injection, consistent with the described vulnerability.exploit.py:21
Sql Injection Payload
Payload withheldThe payload extracts the admin username character by character, consistent with the described vulnerability.exploit.py:38
Sql Injection Payload
Payload withheldThe payload extracts the admin password hash character by character, consistent with the described vulnerability.exploit.py:58
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and exploit.py) were reviewed; no binary or other files were present in the evidence packet.
  • The review does not assess whether the exploit works as claimed or is safe to execute in any environment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubkamranhasan/CVE-2024-1698-ExploitRepository PoCby kamranhasan8Not analyzed3 files

261.9 KiB

GitHub
PoC details
GitHubjesicatjan/WordPress-NotificationX-CVE-2024-1698Repository PoCby jesicatjan1Not analyzed5 files

2.9 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

jesicatjan/WordPress-NotificationX-CVE-2024-1698Created Vuln labCVE-2024-1698Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with a MySQL 5.7 database and a WordPress instance built from a custom Dockerfile that installs the NotificationX 2.8.2 plugin. The README and exploit.py demonstrate a SQL injection attack against the plugin's analytics endpoint.

docker-compose.yml:1-40Dockerfile:1-10README.md:1-20exploit.py:1-33

Lab assessment

Vulnerability lab

The environment includes a vulnerable WordPress plugin (NotificationX 2.8.2) and provides a README with a curl command and an exploit.py script that perform a time-based blind SQL injection to extract the admin password hash. This is a deliberate setup for demonstrating CVE-2024-1698.

Dockerfile:6-9README.md:11-17exploit.py:1-33
Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 5.7 database service for WordPress, configured with environment variables from .env.

docker-compose.yml:4-15

wordpress

web applicationvulnerable target

WordPress service built from a Dockerfile that installs the NotificationX 2.8.2 plugin. Exposes port 80 to the host. The plugin contains a SQL injection vulnerability targeted by the exploit.

docker-compose.yml:18-35Dockerfile:1-10

exploit.py

exploit script

Python script that performs a time-based blind SQL injection against the NotificationX analytics endpoint to extract the WordPress admin password hash.

exploit.py:1-33
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-1698

Supported by supplied evidence

The environment installs NotificationX 2.8.2, which is the vulnerable version for CVE-2024-1698 (SQL injection). The README and exploit.py demonstrate a SQL injection attack against the plugin's analytics endpoint, consistent with the CVE description.

Dockerfile:6-9README.md:11-17exploit.py:1-33
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to build and run the environment.README.md:3-5
  • The .env file with database credentials must be present.docker-compose.yml:9docker-compose.yml:28
  • The WordPress instance must be fully initialized with a user (admin) in the wp_users table for the exploit to extract a password hash.exploit.py:18

Evidence-described exercise path

  1. Build and start the environment with 'docker-compose up --build'.README.md:3-5
  2. Run the provided curl command or exploit.py script to perform a time-based blind SQL injection against the NotificationX analytics endpoint.README.md:11-17exploit.py:1-33
  3. Observe the extracted admin password hash from the response timing.exploit.py:27-33
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The exploit targets the local WordPress container via the exposed port 80, which is expected for demonstrating the SQL injection. No evidence of host escape, external connections, persistence, credential theft beyond the lab's own database, or destructive behavior is present.

docker-compose.yml:1-40Dockerfile:1-10exploit.py:1-33
Review boundaries

What the analysis did not establish

  • The Dockerfile downloads a plugin zip from an external URL (https://downloads.wordpress.org/plugin/notificationx.2.8.2.zip); the content of that zip is not inspected, but the URL is the official WordPress plugin repository.
  • The exploit.py script is provided as a text file; its behavior is visible and matches the described vulnerability exercise.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Nuclei templates

1
ProjectDiscoveryCRITICALNotificationX <= 2.8.2 - SQL InjectionCVSS 9.8

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can extract sensitive database information including usernames, passwords, and other confidential data via time-based SQL injection.

Remediation

Update NotificationX plugin to version 2.8.3 or later.

AuthorsDhiyaneshDk
Template tagstime-based-sqlicvecve2024wpscanwordpresswp-pluginnotificationxsqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wpdeveloper:notificationx:*:*:*:*:wordpress:*:*:*
FOFA: body="/wp-content/plugins/notificationx"
https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Database.php https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php https://www.wordfence.com/threat-intel/vulnerabilities/id/e110ea99-e2fa-4558-bcf3-942a35af0b91?source=cve https://github.com/fkie-cad/nvd-json-data-feeds https://nvd.nist.gov/vuln/detail/CVE-2024-1698

Source: ProjectDiscovery

References

5