SQL Injection in GiveWP Donors Query

Skrevet den af i GiveWP – Donation Plugin

GiveWP up to and including 3.16.1 inserts the user-supplied sort order of the donors query into the SQL ORDER BY clause with only esc_sql(), which does not protect an unquoted value. A user with GiveWP Manager access or higher can inject SQL through the order parameter of the donor list and read data from the database. The patch accepts only ASC or DESC as the sort order.

This vulnerability affects the following application versions:

  • GiveWP – Donation Plugin 1.9.0
  • GiveWP – Donation Plugin 2.0.0
  • GiveWP – Donation Plugin 2.0.1
  • GiveWP – Donation Plugin 2.0.2
  • GiveWP – Donation Plugin 2.0.3
  • GiveWP – Donation Plugin 2.0.4
  • GiveWP – Donation Plugin 2.0.5
  • GiveWP – Donation Plugin 2.0.6
  • GiveWP – Donation Plugin 2.0.7
  • GiveWP – Donation Plugin 2.1.0
  • GiveWP – Donation Plugin 2.1.1
  • GiveWP – Donation Plugin 2.1.2
  • GiveWP – Donation Plugin 2.1.3
  • GiveWP – Donation Plugin 2.1.4
  • GiveWP – Donation Plugin 2.1.5
  • GiveWP – Donation Plugin 2.1.6
  • GiveWP – Donation Plugin 2.1.7
  • GiveWP – Donation Plugin 2.1.8
  • GiveWP – Donation Plugin 2.2.0
  • GiveWP – Donation Plugin 2.2.1
  • GiveWP – Donation Plugin 2.2.2
  • GiveWP – Donation Plugin 2.2.3
  • GiveWP – Donation Plugin 2.2.4
  • GiveWP – Donation Plugin 2.2.5
  • GiveWP – Donation Plugin 2.2.6
  • GiveWP – Donation Plugin 2.3.0
  • GiveWP – Donation Plugin 2.3.1
  • GiveWP – Donation Plugin 2.3.2
  • GiveWP – Donation Plugin 2.4.0
  • GiveWP – Donation Plugin 2.4.1
  • GiveWP – Donation Plugin 2.4.2
  • GiveWP – Donation Plugin 2.4.3
  • GiveWP – Donation Plugin 2.4.4
  • GiveWP – Donation Plugin 2.4.5
  • GiveWP – Donation Plugin 2.4.6
  • GiveWP – Donation Plugin 2.4.7
  • GiveWP – Donation Plugin 2.5.0
  • GiveWP – Donation Plugin 2.5.1
  • GiveWP – Donation Plugin 2.5.2
  • GiveWP – Donation Plugin 2.5.3
  • GiveWP – Donation Plugin 2.5.4
  • GiveWP – Donation Plugin 2.5.5
  • GiveWP – Donation Plugin 2.5.6
  • GiveWP – Donation Plugin 2.5.7
  • GiveWP – Donation Plugin 2.5.8
  • GiveWP – Donation Plugin 2.5.9
  • GiveWP – Donation Plugin 2.5.10
  • GiveWP – Donation Plugin 2.5.11
  • GiveWP – Donation Plugin 2.5.12
  • GiveWP – Donation Plugin 2.5.13
  • GiveWP – Donation Plugin 2.6.0
  • GiveWP – Donation Plugin 2.6.1
  • GiveWP – Donation Plugin 2.6.2
  • GiveWP – Donation Plugin 2.6.3
  • GiveWP – Donation Plugin 2.7.0
  • GiveWP – Donation Plugin 2.7.1
  • GiveWP – Donation Plugin 2.7.2
  • GiveWP – Donation Plugin 2.7.3
  • GiveWP – Donation Plugin 2.7.4
  • GiveWP – Donation Plugin 2.7.5
  • GiveWP – Donation Plugin 2.8.0
  • GiveWP – Donation Plugin 2.8.1
  • GiveWP – Donation Plugin 2.9.0
  • GiveWP – Donation Plugin 2.9.1
  • GiveWP – Donation Plugin 2.9.2
  • GiveWP – Donation Plugin 2.9.3
  • GiveWP – Donation Plugin 2.9.4
  • GiveWP – Donation Plugin 2.9.5
  • GiveWP – Donation Plugin 2.9.6
  • GiveWP – Donation Plugin 2.9.7
  • GiveWP – Donation Plugin 2.10.0
  • GiveWP – Donation Plugin 2.10.1
  • GiveWP – Donation Plugin 2.10.2
  • GiveWP – Donation Plugin 2.10.3
  • GiveWP – Donation Plugin 2.10.4
  • GiveWP – Donation Plugin 2.11.0
  • GiveWP – Donation Plugin 2.11.1
  • GiveWP – Donation Plugin 2.11.2
  • GiveWP – Donation Plugin 2.11.3
  • GiveWP – Donation Plugin 2.12.0
  • GiveWP – Donation Plugin 2.12.1
  • GiveWP – Donation Plugin 2.12.2
  • GiveWP – Donation Plugin 2.12.3
  • GiveWP – Donation Plugin 2.13.0
  • GiveWP – Donation Plugin 2.13.1
  • GiveWP – Donation Plugin 2.13.2
  • GiveWP – Donation Plugin 2.13.3
  • GiveWP – Donation Plugin 2.13.4
  • GiveWP – Donation Plugin 2.14.0
  • GiveWP – Donation Plugin 2.15.0
  • GiveWP – Donation Plugin 2.16.0
  • GiveWP – Donation Plugin 2.16.1
  • GiveWP – Donation Plugin 2.17.0
  • GiveWP – Donation Plugin 2.17.1
  • GiveWP – Donation Plugin 2.17.3
  • GiveWP – Donation Plugin 2.18.0
  • GiveWP – Donation Plugin 2.18.1
  • GiveWP – Donation Plugin 2.19.1
  • GiveWP – Donation Plugin 2.19.2
  • GiveWP – Donation Plugin 2.19.3
  • GiveWP – Donation Plugin 2.19.4
  • GiveWP – Donation Plugin 2.19.5
  • GiveWP – Donation Plugin 2.19.6
  • GiveWP – Donation Plugin 2.19.7
  • GiveWP – Donation Plugin 2.19.8
  • GiveWP – Donation Plugin 2.20.0
  • GiveWP – Donation Plugin 2.20.1
  • GiveWP – Donation Plugin 2.20.2
  • GiveWP – Donation Plugin 2.21.0
  • GiveWP – Donation Plugin 2.21.1
  • GiveWP – Donation Plugin 2.21.2
  • GiveWP – Donation Plugin 2.21.3
  • GiveWP – Donation Plugin 2.21.4
  • GiveWP – Donation Plugin 2.22.0
  • GiveWP – Donation Plugin 2.22.1
  • GiveWP – Donation Plugin 2.22.2
  • GiveWP – Donation Plugin 2.22.3
  • GiveWP – Donation Plugin 2.23.0
  • GiveWP – Donation Plugin 2.23.1
  • GiveWP – Donation Plugin 2.23.2
  • GiveWP – Donation Plugin 2.24.0
  • GiveWP – Donation Plugin 2.24.1
  • GiveWP – Donation Plugin 2.24.2
  • GiveWP – Donation Plugin 2.25.0
  • GiveWP – Donation Plugin 2.25.1
  • GiveWP – Donation Plugin 2.25.2
  • GiveWP – Donation Plugin 2.25.3
  • GiveWP – Donation Plugin 2.26.0
  • GiveWP – Donation Plugin 2.27.0
  • GiveWP – Donation Plugin 2.27.1
  • GiveWP – Donation Plugin 2.27.2
  • GiveWP – Donation Plugin 2.27.3
  • GiveWP – Donation Plugin 2.28.0
  • GiveWP – Donation Plugin 2.29.0
  • GiveWP – Donation Plugin 2.29.1
  • GiveWP – Donation Plugin 2.29.2
  • GiveWP – Donation Plugin 2.30.0
  • GiveWP – Donation Plugin 2.31.0
  • GiveWP – Donation Plugin 2.31.1
  • GiveWP – Donation Plugin 2.32.0
  • GiveWP – Donation Plugin 2.33.0
  • GiveWP – Donation Plugin 2.33.1
  • GiveWP – Donation Plugin 2.33.2
  • GiveWP – Donation Plugin 2.33.3
  • GiveWP – Donation Plugin 2.33.4
  • GiveWP – Donation Plugin 2.33.5
  • GiveWP – Donation Plugin 3.0.0
  • GiveWP – Donation Plugin 3.0.1
  • GiveWP – Donation Plugin 3.0.2
  • GiveWP – Donation Plugin 3.0.3
  • GiveWP – Donation Plugin 3.0.4
  • GiveWP – Donation Plugin 3.1.0
  • GiveWP – Donation Plugin 3.1.1
  • GiveWP – Donation Plugin 3.1.2
  • GiveWP – Donation Plugin 3.2.0
  • GiveWP – Donation Plugin 3.2.1
  • GiveWP – Donation Plugin 3.2.2
  • GiveWP – Donation Plugin 3.3.0
  • GiveWP – Donation Plugin 3.3.1
  • GiveWP – Donation Plugin 3.4.0
  • GiveWP – Donation Plugin 3.4.1
  • GiveWP – Donation Plugin 3.4.2
  • GiveWP – Donation Plugin 3.5.0
  • GiveWP – Donation Plugin 3.5.1
  • GiveWP – Donation Plugin 3.6.0
  • GiveWP – Donation Plugin 3.6.1
  • GiveWP – Donation Plugin 3.6.2
  • GiveWP – Donation Plugin 3.7.0
  • GiveWP – Donation Plugin 3.8.0
  • GiveWP – Donation Plugin 3.9.0
  • GiveWP – Donation Plugin 3.10.0
  • GiveWP – Donation Plugin 3.11.0
  • GiveWP – Donation Plugin 3.12.0
  • GiveWP – Donation Plugin 3.12.1
  • GiveWP – Donation Plugin 3.12.2
  • GiveWP – Donation Plugin 3.12.3
  • GiveWP – Donation Plugin 3.13.0
  • GiveWP – Donation Plugin 3.14.0
  • GiveWP – Donation Plugin 3.14.1
  • GiveWP – Donation Plugin 3.14.2
  • GiveWP – Donation Plugin 3.15.0
  • GiveWP – Donation Plugin 3.15.1
  • GiveWP – Donation Plugin 3.16.0
  • GiveWP – Donation Plugin 3.16.1

Unauthenticated PHP Object Injection in GiveWP Donation and Donor Meta

Skrevet den af i GiveWP – Donation Plugin

GiveWP up to 3.19.4 wrote donation-form fields such as the billing address (card_address) straight into its donation and donor meta tables, bypassing WordPress meta serialisation. A serialised PHP object submitted by an unauthenticated donor is therefore instantiated whenever that meta is read back, which can lead to remote code execution if a POP chain is present on the site.

This vulnerability affects the following application versions:

  • GiveWP – Donation Plugin 2.19.6
  • GiveWP – Donation Plugin 2.19.7
  • GiveWP – Donation Plugin 2.19.8
  • GiveWP – Donation Plugin 2.20.0
  • GiveWP – Donation Plugin 2.20.1
  • GiveWP – Donation Plugin 2.20.2
  • GiveWP – Donation Plugin 2.21.0
  • GiveWP – Donation Plugin 2.21.1
  • GiveWP – Donation Plugin 2.21.2
  • GiveWP – Donation Plugin 2.21.3
  • GiveWP – Donation Plugin 2.21.4
  • GiveWP – Donation Plugin 2.22.0
  • GiveWP – Donation Plugin 2.22.1
  • GiveWP – Donation Plugin 2.22.2
  • GiveWP – Donation Plugin 2.22.3
  • GiveWP – Donation Plugin 2.23.0
  • GiveWP – Donation Plugin 2.23.1
  • GiveWP – Donation Plugin 2.23.2
  • GiveWP – Donation Plugin 2.24.0
  • GiveWP – Donation Plugin 2.24.1
  • GiveWP – Donation Plugin 2.24.2
  • GiveWP – Donation Plugin 2.25.0
  • GiveWP – Donation Plugin 2.25.1
  • GiveWP – Donation Plugin 2.25.2
  • GiveWP – Donation Plugin 2.25.3
  • GiveWP – Donation Plugin 2.26.0
  • GiveWP – Donation Plugin 2.27.0
  • GiveWP – Donation Plugin 2.27.1
  • GiveWP – Donation Plugin 2.27.2
  • GiveWP – Donation Plugin 2.27.3
  • GiveWP – Donation Plugin 2.28.0
  • GiveWP – Donation Plugin 2.29.0
  • GiveWP – Donation Plugin 2.29.1
  • GiveWP – Donation Plugin 2.29.2
  • GiveWP – Donation Plugin 2.30.0
  • GiveWP – Donation Plugin 2.31.0
  • GiveWP – Donation Plugin 2.31.1
  • GiveWP – Donation Plugin 2.32.0
  • GiveWP – Donation Plugin 2.33.0
  • GiveWP – Donation Plugin 2.33.1
  • GiveWP – Donation Plugin 2.33.2
  • GiveWP – Donation Plugin 2.33.3
  • GiveWP – Donation Plugin 2.33.4
  • GiveWP – Donation Plugin 2.33.5
  • GiveWP – Donation Plugin 3.0.0
  • GiveWP – Donation Plugin 3.0.1
  • GiveWP – Donation Plugin 3.0.2
  • GiveWP – Donation Plugin 3.0.3
  • GiveWP – Donation Plugin 3.0.4
  • GiveWP – Donation Plugin 3.1.0
  • GiveWP – Donation Plugin 3.1.1
  • GiveWP – Donation Plugin 3.1.2
  • GiveWP – Donation Plugin 3.2.0
  • GiveWP – Donation Plugin 3.2.1
  • GiveWP – Donation Plugin 3.2.2
  • GiveWP – Donation Plugin 3.3.0
  • GiveWP – Donation Plugin 3.3.1
  • GiveWP – Donation Plugin 3.4.0
  • GiveWP – Donation Plugin 3.4.1
  • GiveWP – Donation Plugin 3.4.2
  • GiveWP – Donation Plugin 3.5.0
  • GiveWP – Donation Plugin 3.5.1
  • GiveWP – Donation Plugin 3.6.0
  • GiveWP – Donation Plugin 3.6.1
  • GiveWP – Donation Plugin 3.6.2
  • GiveWP – Donation Plugin 3.7.0
  • GiveWP – Donation Plugin 3.8.0
  • GiveWP – Donation Plugin 3.9.0
  • GiveWP – Donation Plugin 3.10.0
  • GiveWP – Donation Plugin 3.11.0
  • GiveWP – Donation Plugin 3.12.0
  • GiveWP – Donation Plugin 3.12.1
  • GiveWP – Donation Plugin 3.12.2
  • GiveWP – Donation Plugin 3.12.3
  • GiveWP – Donation Plugin 3.13.0
  • GiveWP – Donation Plugin 3.14.0
  • GiveWP – Donation Plugin 3.14.1
  • GiveWP – Donation Plugin 3.14.2
  • GiveWP – Donation Plugin 3.15.0
  • GiveWP – Donation Plugin 3.15.1
  • GiveWP – Donation Plugin 3.16.0
  • GiveWP – Donation Plugin 3.16.1
  • GiveWP – Donation Plugin 3.16.2
  • GiveWP – Donation Plugin 3.16.3
  • GiveWP – Donation Plugin 3.16.4
  • GiveWP – Donation Plugin 3.16.5
  • GiveWP – Donation Plugin 3.17.0
  • GiveWP – Donation Plugin 3.17.1
  • GiveWP – Donation Plugin 3.17.2
  • GiveWP – Donation Plugin 3.18.0
  • GiveWP – Donation Plugin 3.19.0
  • GiveWP – Donation Plugin 3.19.1
  • GiveWP – Donation Plugin 3.19.2
  • GiveWP – Donation Plugin 3.19.3
  • GiveWP – Donation Plugin 3.19.4