CVE-2023-35910 - Nucleus_genius Quasar form free – Contact Form Builder for WordPress: SQL Injection Vulnerability Discovered and Uncovered

Security researchers have discovered a major security vulnerability (CVE-2023-35910) impacting Nucleus_genius Quasar form free – Contact Form Builder for WordPress, a popular contact form builder plugin, which allows malicious users to exploit SQL Injection and gain unauthorized access to sensitive information stored in the WordPress database. This issue has been found to affect versions from n/a through 6..

In this post, we will discuss the technical details of the vulnerability, how it can be exploited, and what developers can do to protect against it.

Exploit Details

The vulnerability exists due to the improper neutralization of special elements used in an SQL command, leading to what is commonly known as SQL injection vulnerability.

When a user submits a form created using the Quasar form plugin, the data is processed and sanitized before being inserted into the database. However, it has been discovered that the sanitization process is not sufficient, allowing an attacker to include specially crafted data in the form submission that contains malicious SQL statements.

An attacker can then manipulate the SQL query, allowing them to read, modify or delete data from the WordPress database, potentially gaining access to sensitive user information or other confidential data.

Here's a simplified example of the affected code snippet

//Code snippet displaying the vulnerability
$query = "INSERT INTO " . $table_name . " (field_value) VALUES ('" . $sanitized_value . "')";

As the $sanitized_value is not adequately sanitized, any user input that contains SQL statements will be executed in the query. This can lead to potentially dangerous results.

Proof of Concept

An attacker could exploit the SQL injection vulnerability by submitting a form created with the Quasar form plugin and including malicious SQL commands in the form data. For example, they can input the following data in the form field:

x'); DROP TABLE users; --

This would lead to the following SQL query being executed

INSERT INTO tablename (field_value) VALUES ('x'); DROP TABLE users; --');

As a result, the entire users' table could be deleted from the WordPress database.

Original references

1. CVE Details
2. National Vulnerability Database (NVD)
3. WordPress.org Plugin Page

Mitigation

To protect against this vulnerability, it's essential to ensure that you're using the most recent version of the Quasar form plugin and WordPress. Plugin developers have been notified of the issue and are working on a patch to fix it. Meanwhile, it's important to pay attention to any updates and security announcements related to this issue.

As a temporary measure, you can disable user registration on your WordPress website, monitor any suspicious activity in your logs, and consider using alternative form builder plugins or custom solutions that have proper input validation and sanitization.

Conclusion

Security vulnerabilities such as this CVE-2023-35910 SQL injection vulnerability in the Nucleus_genius Quasar form free – Contact Form Builder for WordPress plugin are an ongoing concern. Make sure you stay informed on security updates and always follow recommended best practices for maintaining the security of your WordPress site.

Timeline

Published on: 11/04/2023 00:15:08 UTC
Last modified on: 11/09/2023 20:10:03 UTC