JTRT Responsive Tables <= 4.1 – Authenticated SQL Injection

Type user access: single user. $_POST[‘tableId’] is not escaped. File / Code: Path: /wp-content/plugins/jtrt-responsive-tables/admin/class-jtrt-responsive-tables-admin.php Line : 183 $getTableId = $_POST[‘tableId’]; … $retrieve_data = $wpdb->get_results( "SELECT * FROM $jtrt_tables_name WHERE jttable_IDD = " . $getTableId );

PoC

1 – Log in with single user. 2 – Using form, sqli by post: