PT-2023-20414 · WordPress · Active Directory Integration
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Active Directory Integration plugin for WordPress versions up to, and including, 4.1.4
Description
The issue allows unauthenticated attackers to perform time-based SQL Injection via the
orderby and order parameters due to missing nonce verification on the get users function, insufficient escaping on the user-supplied parameter, and lack of sufficient preparation on the existing SQL query. This can lead to resource exhaustion by appending additional SQL queries into already existing queries through a forged request, granted they can trick an administrator into performing an action such as clicking on a link.Recommendations
For versions up to, and including, 4.1.4, update to a version that includes nonce verification on the
get users function and sufficient escaping on the user-supplied parameters to prevent SQL Injection.
As a temporary workaround, consider restricting access to the get users function until a patch is available.
Avoid using the orderby and order parameters in affected API endpoints until the issue is resolved.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Active Directory Integration