SQL Injection in PDF Invoices & Packing Slips for WooCommerce Number Tools

Skrevet den af i PDF Invoices & Packing Slips for WooCommerce

The Advanced > Numbers (Number Tools) list table in PDF Invoices & Packing Slips for WooCommerce up to 3.7.5 inserts the table_name, order, orderby and search request parameters into a SQL query without whitelisting them. A user with the manage_woocommerce capability (administrator or shop manager) can inject SQL and read arbitrary database contents.

This vulnerability affects the following application versions:

  • PDF Invoices & Packing Slips for WooCommerce 3.7.2
  • PDF Invoices & Packing Slips for WooCommerce 3.7.3
  • PDF Invoices & Packing Slips for WooCommerce 3.7.4
  • PDF Invoices & Packing Slips for WooCommerce 3.7.5
  • PDF Invoices & Packing Slips for WooCommerce 3.7.6