404 Solution < 2.35.8 – Admin+ SQL Injection | CVE 2024-1068 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.

Proof of Concept

1. navigate to logs "https://example.com/wp-admin/options-general.php?page=abj404_solution&subpage=abj404_logs".
2.Click on any function like date to sort result. Observe request and response.
3. Add payload in order parameter. Payload "%2c(select*from(select(sleep(20)))a)".
4.Observe payload executed successfully

Affects Plugins

Fixed in 2.35.8

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Sumit Patel

Submitter

Sumit Patel

Submitter website

https://www.linkedin.com/in/ipatelsumit/

Verified

Yes

WPVDB ID

25e3c1a1-3c45-41df-ae50-0e20d86c5484

Timeline

Publicly Published

2024-02-17 (about 1 year ago)

Added

2024-02-17 (about 1 year ago)

Last Updated

2024-02-17 (about 1 year ago)

Other

Published

Title

Published

2018-01-28

Title

User Control - Unauthenticated SQL Injection

Published

2024-09-06

Title

Pinpoint Booking System < 2.9.9.5.1- Authenticated (Subscriber+) SQL Injection

Published

2021-06-29

Title

FAQ Builder < 1.3.6 - Authenticated Blind SQL Injections

Published

2015-04-07

Title

All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection

Published

2020-04-28

Title

WP-Advanced-Search < 3.3.7 - Authenticated SQL Injection