Régis Senet

The Askeet plugin for WordPress contains a flaw allowing authenticated attackers with Administrator-level access and above to perform SQL Injection. The issue exists within the `sql query` parameter used in the `askeet execute sql query()` and `askeet export all results()` AJAX actions. This occurs because the `askeet is safe query()` filter can be bypassed using MySQL conditional comments, which are special comments that MySQL executes as code. While the filter removes standard block comments, it fails to account for conditional comments, enabling the execution of unauthorized SQL queries to extract sensitive database information.

This issue is a SQL Injection, which occurs when an attacker can interfere with the queries that an application makes to its database. Authenticated users with subscriber-level access and above can append additional SQL queries to existing ones to extract sensitive information from the database. This is caused by insufficient escaping of the user-supplied `arttype` parameter and a lack of sufficient preparation on the existing SQL query.

The cms-fuer-motorrad-werkstaetten plugin for WordPress is susceptible to Cross-Site Request Forgery. This occurs because eight AJAX deletion handlers lack nonce validation and do not perform capability checks via `current user can()`. The affected handlers are 'vehicles cfmw d vehicle', 'contacts cfmw d contact', 'suppliers cfmw d supplier', 'receipts cfmw d receipt', 'positions cfmw d position', 'catalogs cfmw d article', 'stock cfmw d item', and 'settings cfmw d catalog'. Consequently, unauthenticated attackers can delete arbitrary vehicles, contacts, suppliers, receipts, positions, catalog articles, stock items, or entire supplier catalogs by tricking a logged-in user into clicking a malicious link.

The issue is related to Cross-Site Request Forgery, caused by missing or incorrect nonce validation in the `aha plugin page()` function. This allows unauthenticated attackers to delete AHA pages by tricking a site administrator into performing an action, such as clicking on a link.

The issue is related to time-based SQL Injection via the `id` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with Administrator-level access and above to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database.

The issue allows admins to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement.

Name of the Vulnerable Software and Affected Versions: AHAthat Plugin WordPress plugin versions 1.6 and earlier Description: The issue allows Admin to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For AHAthat Plugin WordPress plugin versions 1.6 and earlier, update to a version that includes the necessary sanitization and escaping of parameters in SQL statements to prevent SQL injection attacks.

Name of the Vulnerable Software and Affected Versions: JSP Store Locator WordPress plugin versions 1.0 and earlier Description: The issue allows users with Contributor access to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before its use in a SQL statement. Recommendations: For JSP Store Locator WordPress plugin versions 1.0 and earlier, update to a version that addresses this issue, as using unsanitized input in SQL statements poses a significant risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The Connexion Logs WordPress plugin versions 3.0.2 and earlier Description: The issue allows admins to perform SQL injection attacks due to a parameter not being sanitized and escaped before use in a SQL statement. Recommendations: For The Connexion Logs WordPress plugin versions 3.0.2 and earlier, update to a version that includes the necessary sanitization and escaping of parameters in SQL statements to prevent SQL injection attacks.