WP Directory Kit SQL Injection Vulnerability in select_2_ajax Function

A SQL injection vulnerability has been identified in the WP Directory Kit plugin for WordPress, affecting all versions through 1.4.3. The issue arises in the select_2_ajax() function, where the 'columns_search' parameter is not properly sanitized before being used in an SQL query. This flaw allows unauthenticated attackers to manipulate the SQL query by appending additional commands, potentially leading to the extraction of sensitive data from the database.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the select_2_ajax() function with a crafted 'columns_search' parameter that includes malicious SQL code. The lack of proper escaping will allow the injected SQL to be executed, manipulating the original query and potentially exposing database information.

Remediation

Users are advised to update the WP Directory Kit plugin to version 1.4.4 or later, where this vulnerability has been patched.