KKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL Injection

2024-05-0600:00:00

Bob Matyas

wpscan.com

sql injection

admin+

free plugin

may 20 2024

update

vulnerability

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks

PoC

1. Send a POST request to /wp-admin/admin.php?page=kkpb-add-project with the BODY action=edit-project&id;=sleep(5) 2. Observe the delay in response