Contest Gallery WordPress Plugin Blind SQL Injection Vulnerability

A blind SQL injection vulnerability has been identified in the Contest Gallery WordPress plugin, specifically in versions through 28.1.4. The vulnerability arises from inadequate escaping of user-supplied data in the 'cgLostPasswordEmail' and 'cgl_mail' parameters, allowing unauthenticated attackers to inject additional SQL queries. This exploitation could lead to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for blind SQL injection, where an attacker can manipulate SQL queries to extract data from the database.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site with the 'cgLostPasswordEmail' or 'cgl_mail' parameter. The injected SQL payload can be appended to exploit the SQL injection vulnerability. The 'cgLostPasswordEmail' parameter is processed by the 'users-login-check-ajax-lost-password.php' file, while the 'cgl_mail' parameter is handled by the 'cg-user-functions.php' file.

Remediation

Users can update to version 28.1.5 or a newer patched version to address this vulnerability.