Pods < 3.2.8.2 – Admin+ SQL Injection | CVE 2025-1446 | Plugin Vulnerabilities

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Proof of Concept

1) Create a new Users pod. 
2) Add new field to this pod
3) Choose Relationship field.
4) Change "Related type" to "Users"
5) Go to "Relationship Options" and change "Selection Type" to "Multi Select"
6) Change "Customized ORDER BY" field to `123 AND (select sleep(5)) -- `
7) View a user profile and see the delay showing the successful SQL injection

Affects Plugins

Fixed in 3.2.8.2

References

CVE

URL

https://research.cleantalk.org/cve-2025-1446/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

c170fb45-7ed5-40ef-99f6-8da035a23d89

Timeline

Publicly Published

2025-03-02 (about 10 months ago)

Added

2025-03-02 (about 10 months ago)

Last Updated

2025-04-07 (about 8 months ago)

Other

Published

Title

Published

2025-03-31

Title

My auctions allegro < 3.6.21 - Contributor+ SQLi

Published

2024-02-15

Title

postMash – custom post order <= 1.2.0 - Unauthenticated SQL Injection

Published

2025-03-31

Title

Behance Portfolio Manager <= 1.7.4 - Authenticated (Contributor+) SQL Injection

Published

2021-10-11

Title

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections

Published

2022-01-07

Title

Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection