In recent days, a serious security vulnerability has been discovered in the Left Right Image Slideshow Gallery plugin for WordPress. The vulnerability, identified as CVE-2023-5431, allows attackers to perform SQL Injection attacks on websites using the plugin in versions up to, and including, 12.. In this post, we will discuss the technical details of this vulnerability, how the attackers can exploit it, and what steps you should take to protect your website from such attacks.

The Vulnerability (CVE-2023-5431)

The Left Right Image Slideshow Gallery plugin is a popular tool for adding stylish image slideshows to WordPress websites. The plugin allows users to create galleries, add images, and manage them through shortcodes on their pages. Unfortunately, the plugin's developers have failed to properly escape a user-supplied parameter in the shortcode and did not prepare the SQL query adequately, which makes the plugin vulnerable to SQL injection attacks.

Technical Details

The vulnerability in question stems from insufficient escaping on a user-supplied parameter in the plugin's shortcode function. This lack of escaping allows an authenticated attacker with subscriber-level permissions or higher to inject additional SQL queries into an existing query, potentially leading to the extraction of sensitive information from the website's database.

Here is an example of the vulnerable code in the plugin

function left_right_image_slideshow_gallery_shortcode($atts) {
    extract(shortcode_atts(array(
        'id' => '',
    ), $atts));

    // The following line is vulnerable to SQL injection
    $query = "SELECT * FROM " . WP_LRISG_TABLE . " WHERE id = " . $id;
    $data = $wpdb->get_results($query);

    // ... (rest of the code)
}

As you can see, the $id parameter from the shortcode is directly appended to the SQL query without proper escaping or validation, thereby making it vulnerable to SQL injection.

Exploit Details

To exploit this vulnerability, an attacker needs to have at least subscriber-level access to the WordPress website. Once logged in, the attacker can insert a malicious shortcode into any page or post they have permission to edit. The malicious shortcode could look like this:

[left_right_image_slideshow_gallery id="1; DROP TABLE wp_users --"]

When the page containing the malicious shortcode is loaded, the DROP TABLE wp_users query will be executed along with the original SQL query, resulting in the deletion of the wp_users table from the database.

It is important to note that this exploit is just an example, and a skilled attacker could perform much more sophisticated attacks to extract sensitive information from the database or even gain unauthorized access to the website.

To protect your website from this vulnerability, you should take the following steps

1. Update the Left Right Image Slideshow Gallery plugin to the latest version (if an update addressing this vulnerability is available). Keep an eye on the plugin's changelog to see when the fix has been released.

2. As a temporary workaround, you can disable the vulnerable shortcode by commenting out the corresponding line in the plugin's PHP file:

// Comment the following line to disable the vulnerable shortcode
// add_shortcode('left_right_image_slideshow_gallery', 'left_right_image_slideshow_gallery_shortcode');

3. Educate your website's users about the importance of strong, unique passwords, and implement role-based access control to limit the permissions granted to different user types.

Conclusion

In conclusion, CVE-2023-5431 is a serious vulnerability in the Left Right Image Slideshow Gallery plugin for WordPress that allows attackers to perform SQL Injection attacks. It is crucial for website owners and administrators to take necessary actions to mitigate the risks associated with this vulnerability. By updating the plugin to the latest version and implementing strong security measures, you can help protect your website from potential security breaches.

Timeline

Published on: 10/31/2023 09:15:00 UTC
Last modified on: 11/07/2023 04:24:00 UTC