WordPress Plugin Vulnerabilities
Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
Description
The plugin is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
Proof of Concept
To exploit the vulnerability, someone must send a specifically crafted request adding a new language containing specific special characters, and then open another page and measure the response time to retrieve data. This can be automated via sqlmap.
Affects Plugins
Fixed in version 2.3.3
References
Classification
Miscellaneous
Original Researcher
Elias Hohl
Submitter
Elias Hohl
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-07-23 (about 6 months ago)
Added
2022-09-06 (about 4 months ago)
Last Updated
2022-09-06 (about 4 months ago)