CVE-2022-51021: NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP payloads, along with an apikey derived from md5(homeurl()), which flows unsanitized into Database::getwherequery to extract database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerable REST endpoint is remotely reachable and does not require authentication or user interaction. An attacker needs to supply an array-form id parameter containing crafted SQL and an api_key derived from the site's md5(home_url()) value.
Which installations are affected?
NotificationX versions from 2.0.0 up to, but not including, 2.3.12 are affected. The issue is in the notification REST endpoint at /wp-json/notificationx/v1/notification/{id}.
What can exploitation allow an attacker to do?
The injected id value reaches Database::get_where_query without sanitization, allowing manipulation of database queries. The described attack can be used to extract database contents, including through time-based SQL payloads.
Has this vulnerability been seen exploited?
Yes. The provided data states that the Shadowserver Foundation first observed exploitation evidence on 2023-10-18.