HTTP Headers < 1.18.8 – Admin+ SQL Injection | CVE 2023-1207 | Plugin Vulnerabilities

Description

This plugin has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.

Proof of Concept

1. Create an SQL file with the following contents:

UPDATE wp_options SET option_value = "Hacked" WHERE option_name = "blogname"

2. As an admin user within WP Admin, navigate to Settings > HTTP Headers > Advanced settings.
3. In the "Import" section, click on "Choose file..." and select the SQL file created above.
4. Click "Import settings".
5. Navigate to "Settings" in the sidebar and notice that the "Site Title" has been changed to "Hacked".

Affects Plugins

Fixed in 1.18.8

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

qerogram(at Kakao Style Corp.)

Submitter

qerogram(at Kakao Style Corp.)

Submitter website

https://github.com/qerogram

Verified

Yes

WPVDB ID

6f3f460b-542a-4d32-8feb-afa1aef57e37

Timeline

Publicly Published

2023-04-24 (about 2 years ago)

Added

2023-04-24 (about 2 years ago)

Last Updated

2023-04-25 (about 2 years ago)

Other

Published

Title

Published

2024-07-01

Title

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce < 5.7.26 - Unauthenticated SQL Injection via unsubscribe

Published

2024-10-09

Title

TS Poll < 2.4.1 - Admin+ SQLi

Published

2024-09-25

Title

Classic Editor and Classic Widgets < 1.4.2 - Authenticated (Subscriber+) SQL Injection

Published

2024-09-11

Title

LearnPress – WordPress LMS Plugin < 4.2.7.1 - Unauthenticated SQL Injection via 'c_only_fields'

Published

2022-05-23

Title

KiviCare < 2.3.9 - Unauthenticated SQLi