Simple Membership <= 4.0.3 - Authenticated (Admin+) SQL Injections

2021-04-05 00:00
Martin Vierula

Strategic Overview

Status
Patched in 4.0.4
Affected PluginSimple Membership
Affected Version<= 4.0.3
CVSS7.2High
CVEN/A
View all Simple Membership vulnerabilities

Vulnerability Overview

The Simple Membership plugin for WordPress is vulnerable to time-based SQL Injection via the 's' and 'status' parameters in versions up to, and including, 4.0.3 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated Admin+ attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Technical Analysis

REMEDIATION: Update to version 4.0.4, or a newer patched version --- IDENTIFIER: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C