Short URL WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Short URL WordPress plugin, affecting versions through 1.6.8. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into SQL statements. This vulnerability can be exploited by users with relatively low privileges on the site, such as subscribers.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Reproduction

To reproduce this vulnerability, log in as a subscriber and send a POST request to '/wp-admin/admin-ajax.php' with the 'action' parameter set to 'valid_link' or 'reset_link' and the 'idLink' parameter crafted to exploit the SQL injection, such as using a payload that includes SQL injection techniques like 'OR sleep(10)'.