CVE-2024-9796

This is a functional PoC for CVE-2024-9796, demonstrating SQL injection in the WP Advanced Search plugin for WordPress via unsanitized GET parameters. The exploit targets the autocompletion endpoint to extract user credentials or database information.

This repository provides a proof-of-concept for an unauthenticated SQL injection vulnerability in the WordPress WP-Advanced-Search plugin (versions up to 3.3.9). The exploit leverages a time-based blind SQL injection via the 'f' parameter in an autocompletion endpoint.

This PoC demonstrates an unauthenticated SQL injection vulnerability in WP-Advanced-Search < 3.3.9.2, allowing an attacker to dump WordPress user credentials and password hashes. The exploit constructs a malicious SQL query via URL parameters to extract data from the wp_users table.

The repository appears to be a stub or placeholder for CVE-2024-9796, containing standard WordPress files without any exploit code or clear vulnerability demonstration. The README incorrectly references CVE-2024-9797, suggesting a possible typo or mislabeling.