WordPress Plugin Vulnerabilities

5 Stars Rating Funnel < 1.2.53 - Unauthenticated SQLi

Description

The plugin does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.

Proof of Concept

Affects Plugins

Plugin icon
5-stars-rating-funnel
Fixed in 1.2.53

References

CVE
CVE-2022-0657

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
cydave
Submitter
cydave
Submitter website
https://cyllective.com/
Submitter twitter
cyllective
Verified
Yes
WPVDB ID
e7fe8218-4ef5-4ef9-9850-8567c207e8e6

Timeline

Publicly Published
2022-03-29 (about 3 years ago)
Added
2022-03-29 (about 3 years ago)
Last Updated
2022-04-13 (about 3 years ago)

Other

Published
Title
Published
2023-06-05
Title
WP Brutal AI < 2.0.0 - SQL Injection via CSRF
Published
2024-08-07
Title
Cost Calculator Builder < 3.2.16 - Unauthenticated SQL Injection
Published
2021-10-05
Title
WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection
Published
2015-07-23
Title
SendPress Newsletters < 1.2 - Authenticated SQL Injection
Published
2021-07-24
Title
Timeline Calendar <= 1.2 - Authenticated (admin+) SQL Injection