WordPress Plugin Vulnerabilities

AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection

Description

The plugin does not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.

Proof of Concept

https://drive.google.com/file/d/1UBTpW3RcPR7iqTi94ueyXLwWH8aFHuoe/view?usp=sharing

Payload: [aps-social id="1 and sleep(3)"]

Affects Plugins

Plugin icon
accesspress-social-icons
Fixed in 1.8.1

References

CVE
CVE-2021-24143
Exploitdb
49115
URL
https://plugins.trac.wordpress.org/changeset/2409015/accesspress-social-icons/trunk/inc/frontend/shortcode.php?old=2139884

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.3 (high)

Miscellaneous

Original Researcher
Nguyen Van Khanh - SunCSR (Sun* Cyber Security Research)
Submitter
khanh
Submitter website
http://research.sun-asterisk.com/
Verified
Yes
WPVDB ID
02c5e10c-1ac7-447e-8ae5-b6d251be750b

Timeline

Publicly Published
2020-11-02 (about 3 years ago)
Added
2020-11-02 (about 3 years ago)
Last Updated
2021-01-22 (about 3 years ago)

Other

Published
Title
Published
2024-03-28
Title
CRM Perks Forms < 1.1.5 - Authenticated (Contributor+) SQL Injection
Published
2021-11-15
Title
Mediamatic < 2.8.1 - Subscriber+ SQL Injection
Published
2014-09-19
Title
FB Gorilla - SQL Injection
Published
2021-01-29
Title
Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection
Published
2018-02-22
Title
Custom Permalinks <= 1.1 - Authenticated SQL Injection