JTRT Responsive Tables < 4.1.2 – Authenticated SQL Injection

Description

Type user access: single user.
$_POST[‘tableId’] is not escaped.

File / Code:

Path: /wp-content/plugins/jtrt-responsive-tables/admin/class-jtrt-responsive-tables-admin.php

Line : 183

$getTableId = $_POST['tableId'];
...
$retrieve_data = $wpdb->get_results( "SELECT * FROM $jtrt_tables_name WHERE jttable_IDD = " . $getTableId );