Quotes Llama WordPress Plugin SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Quotes Llama WordPress plugin, affecting versions prior to 3.1.6. The issue arises because the plugin fails to properly sanitize and escape user-supplied parameters before incorporating them into SQL queries. This flaw allows unauthenticated attackers to execute UNION-based SQL injection attacks, potentially leading to the extraction of arbitrary data from the database, including password hashes.

Impact

Exploitation of this vulnerability allows for UNION-based SQL injection, enabling attackers to read arbitrary data from the database, such as password hashes.

Reproduction

To reproduce this vulnerability, first ensure that a public page is using a Quotes Llama shortcode that displays the nonce, along with at least one quote in the plugin's database. As an anonymous user, access the page and retrieve the quotes_llama_nonce value from the HTML. Then, send a POST request to 'wp-admin/admin-ajax.php' with the 'action' parameter set to 'select_search', the 'nonce' parameter containing the retrieved nonce, and the 'sc' parameter set to 'quote OR 1=1#'. This injection bypasses the normal search functionality, demonstrating that the 'sc' parameter is vulnerable to SQL injection. Finally, exploit the vulnerability by injecting a UNION SELECT payload into the 'sc' parameter to extract data from the database, such as user login and password hash information.

Remediation

Users are advised to update the Quotes Llama WordPress plugin to version 3.1.6 or later.