WordPress Plugin Vulnerabilities
Speed Booster Pack < 4.3.3.1 - Admin+ SQL Injection
Description
The plugin does not escape the sbp_convert_table_name parameter before using it in a SQL statement to convert the related table, leading to an SQL injection
Proof of Concept
https://example.com/wp-admin/admin-ajax.php?action=sbp_database_action&sbp_action=convert_tables&sbp_convert_table_name=SQLi&nonce=b2d6208254 The nonce is obtained when Converting a table to InnoDB (/wp-admin/admin.php?page=sbp-settings#tab=database-optimization) and capturing the request
Affects Plugins
Fixed in 4.3.3.1 References
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Quan, Hoang Xuan
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-10-16 (about 2 years ago)
Added
2021-12-01 (about 2 years ago)
Last Updated
2022-04-09 (about 2 years ago)
WPScan 