WordPress Plugin WP Statistics 13.0.7 Time Based SQLI

Description

A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands. ^OWASP

Recommendation

Upgrade to wp-statistics 13.0.8 (or above)

References

• WP Statistics
• OWASP: SQL Injection
• OWASP: ESAPI project
• Wikipedia: Prepared statement
• WordPress
• OWASP 2017-A9
• OWASP 2021-A6
• CWE-89
• OWASP 2017-A1
• OWASP 2021-A3
• CWE-20