Executive Summary

The Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability caused by improper input sanitization of the 'id' POST parameter.

This flaw allows unauthenticated attackers to send crafted SQL queries to the modal.php endpoint, enabling them to execute arbitrary SQL commands on the database.

By exploiting this vulnerability, attackers can extract sensitive information from the WordPress database, such as terms and configuration data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive database information.

• Attackers can extract WordPress terms and configuration data.
• It allows execution of arbitrary SQL queries without authentication.
• Potential compromise of the integrity and confidentiality of the WordPress site’s data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or crafted POST requests targeting the modal.php endpoint of the Answer My Question WordPress plugin, specifically those containing the 'id' parameter with suspicious SQL injection payloads.

A practical detection method is to use network traffic inspection tools or web application firewalls to log and analyze POST requests to modal.php for SQL injection patterns.

For example, using curl to test the vulnerability manually:

• curl -X POST -d "id=1' OR '1'='1" http://yourwordpresssite/wp-content/plugins/answer-my-question/modal.php

If the response contains unexpected database information or errors, it indicates the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or removing the vulnerable Answer My Question plugin version 1.3 or earlier from your WordPress installation.

Since the plugin is no longer maintained or available for download, upgrading to a fixed version is not possible.

Additional measures include implementing web application firewall (WAF) rules to block malicious POST requests targeting modal.php with suspicious 'id' parameters.

Also, monitor your logs for any signs of exploitation attempts and restrict access to the plugin files if possible.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries and extract sensitive database information, including WordPress terms and configuration data.

Such unauthorized access to sensitive data could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information from unauthorized access or disclosure.

However, the provided context and resources do not explicitly discuss the impact of this vulnerability on compliance with specific standards or regulations.

Useful 0 Not Useful 0