wpForo Forum SQL Injection Vulnerability in Members Function

A vulnerability allowing error-based or time-based SQL injection has been identified in the wpForo Forum plugin for WordPress, affecting all versions through 2.4.8. The issue arises in the get_members() function, where the 'offset' and 'row_count' parameters are not properly validated. This lack of validation allows unauthenticated attackers to manipulate the 'row_count' parameter, injecting malicious SQL that could be used to extract sensitive information from the database.

Impact

Exploitation of this vulnerability allows for error-based or time-based blind SQL injection, with the potential to extract sensitive information from the database.

Reproduction

The vulnerability can be reproduced by sending a request to the get_members() function with manipulated 'row_count' and 'offset' parameters. The 'row_count' parameter can be crafted to include a stored procedure call, taking advantage of the SQL injection vulnerability.

Remediation

Users are advised to update the wpForo Forum plugin to version 2.4.9 or later.