JoomSport WordPress Plugin SQL Injection Vulnerability

A time-based blind SQL injection vulnerability has been identified in the JoomSport WordPress plugin, specifically in versions through 5.7.7. The issue arises in the 'sortf' parameter, where insufficient escaping of user-supplied data allows unauthenticated attackers to inject additional SQL queries. This exploitation could lead to the extraction of sensitive information from the database.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can manipulate SQL queries to extract data from the database.

Reproduction

The vulnerability can be reproduced by sending a request to a JoomSport player list endpoint with a crafted 'sortf' parameter. The injected SQL payload can be designed to extract data from the database, taking advantage of the application's SQL query handling.

Remediation

Users are advised to update the JoomSport WordPress plugin to version 5.7.8 or later.