Ajax WooSearch WordPress Plugin Unauthenticated SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Ajax WooSearch WordPress plugin, affecting versions through 1.0.0. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This vulnerability is accessible via an AJAX action available to unauthenticated users.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a POST request to 'wp-admin/admin-ajax.php' with the 'action' parameter set to 'woos_search_product_action'. Include a 'keyword' and 'category' parameter. The 'category' parameter can be crafted to inject SQL, such as by using a payload that exploits the SQL query handling, like adding a SQL injection payload that, for example, uses 'SLEEP' to demonstrate the injection.