Attention Bar WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Attention Bar WordPress plugin, affecting versions through 0.7.2.1. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This flaw enables high-privilege users, such as administrators, to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, a user with contributor privileges can send a request to 'wp-admin/admin.php' with the 'page' parameter set to 'pd_nb_entries'. Include a 'delete' parameter and an 'id' parameter with a crafted SQL payload that exploits the injection vulnerability. The response will exhibit a delay, indicating successful exploitation.