Executive Summary

The WP Review Slider Pro plugin for WordPress has a vulnerability known as SQL Injection in its versions up to and including 12.6.8. This occurs through the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action. The issue arises because the plugin uses stripslashes() on user-supplied JSON strings before decoding them, which removes necessary escaping. The decoded data is then directly concatenated into SQL WHERE clauses without proper parameterization or preparation, allowing attackers to inject malicious SQL queries.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to append additional SQL queries to existing ones. This can be used to extract sensitive information from the database. Additionally, the plugin returns the executed SQL string in its JSON response, which makes it easier for attackers to perform blind SQL injection attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive database information. Attackers with even low-level authenticated access can exploit the SQL Injection flaw to extract confidential data, potentially compromising user data, site content, and other sensitive information stored in the database.

Because the vulnerability allows execution of arbitrary SQL queries, it can also lead to data manipulation or deletion, affecting the integrity and availability of the website's data. This can result in loss of customer trust, damage to the website's reputation, and potential financial losses.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring AJAX requests to the wppro_get_overall_chart_data action in the WP Review Slider Pro plugin, specifically looking for the 'stypes' and 'slocations' parameters being used in requests.

Since the vulnerability involves SQL Injection via these parameters, detection can involve inspecting HTTP requests for suspicious or malformed input in these parameters.

Additionally, because the handler returns the executed SQL string in its JSON response, analyzing responses for unexpected SQL query strings can help identify exploitation attempts.

• Use network monitoring tools (e.g., Wireshark, tcpdump) to capture HTTP POST requests to admin-ajax.php with the action=wppro_get_overall_chart_data.
• Use curl or wget commands to manually test the endpoint, for example:
• curl -X POST -d 'action=wppro_get_overall_chart_data&stypes=[test]&slocations=[test]' https://yourwordpresssite.com/wp-admin/admin-ajax.php -v
• Look for SQL error messages or unexpected SQL query strings in the JSON response.
• Check WordPress logs or database logs for suspicious queries that include injected SQL code.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WP Review Slider Pro plugin to a version later than 12.6.8 where this SQL Injection vulnerability is fixed.

If an update is not immediately available, restrict access to the vulnerable AJAX action by limiting authenticated user roles that can access it, since the vulnerability requires Subscriber-level access or higher.

Additionally, consider implementing Web Application Firewall (WAF) rules to block suspicious requests targeting the 'wppro_get_overall_chart_data' AJAX action with unusual 'stypes' or 'slocations' parameters.

Monitor logs for exploitation attempts and consider temporarily disabling the plugin if the risk is high and no patch is available.

Useful 0 Not Useful 0