[CVE-2022-1505] Unauthenticated SQL injection in RSVPmaker version 9.2.6
Description
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6
Additional information
In the stripesuccess
API (which does not require authentication), it takes a parameter directly from a users request called rsvp_id
as such:
$rsvp_id = $vars['rsvp_id'];
This value is the used (in the same function) directly in an SQL query unsanitized:
$wpdb->query( 'UPDATE ' . $wpdb->prefix . "rsvpmaker SET amountpaid='$paid' WHERE id=$rsvp_id " );
Fix
The fix for the vulnerability in this case is quite simple, just make sure that the rsvp_id
is always an integer:
$rsvp_id = intval($vars['rsvp_id']);
It was fixed in the following commit: https://github.com/davidfcarr/rsvpmaker/commit/3bd8e7d83530d2a75fdfd9df34e078ccbc8a9418