3DPrint Lite WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the 3DPrint Lite plugin for WordPress, affecting all versions up to and including 2.1.3.6. The vulnerability arises from inadequate escaping of user-supplied data in the 'printer_text' parameter, allowing unauthenticated attackers to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information within the database.

Impact

Exploitation of this vulnerability allows for SQL injection, enabling attackers to manipulate database queries and potentially access or modify sensitive database information.

Reproduction

To reproduce this vulnerability, send a request to a WordPress site with the 3DPrint Lite plugin installed, using the 'printer_text' parameter. The injected SQL code can be appended to the parameter, taking advantage of the insufficient escaping to manipulate the SQL query. This can be done by crafting a request that includes the desired SQL injection payload in the 'printer_text' parameter, targeting vulnerable SQL query handling in the plugin.

Remediation

Users are advised to update the 3DPrint Lite WordPress plugin to version 2.1.3.6 or later, where this vulnerability has been addressed.