iThemes Security <= 7.0.2 - Authenticated SQL Injection

Description

The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.

Vulnerability description:

iThemes Security appears to be vulnerable to time-based SQL-Injection.

Parameter orderby is vulnerable because backend variable $sort_by_column
is not escaped.

Privileges required: Admin user.

Technical details:

File: better-wp-security/core/admin-pages/logs-list-table.php
Line 271: if ( isset( $_GET['​ orderby​ '], $_GET['order'] ) ) {
Line 272: $​ sort_by_column​ = $_GET['​ orderby​ '];

File: better-wp-security/core/lib/log-util.php
Line 168: $query .= ' ORDER BY ' . implode( ', ', $​ sort_by_column​ ));