CVE-2019-25746

Vulnerability

WordPress Sliced Invoices versions 3.8.2 and earlier contain an authenticated SQL injection vulnerability. The flaw resides in the admin.php endpoint, specifically in the duplicate_quote_invoice action. An attacker can inject arbitrary SQL code through the post parameter, which is not properly sanitized before being used in a database query. This vulnerability requires the attacker to have an authenticated WordPress user account.

Exploitation

An authenticated attacker with a WordPress user account can send a crafted HTTP request to admin.php?action=duplicate_quote_invoice with a malicious post parameter value. For example, appending and (select*from(select(sleep(20)))a)--%20 to the post parameter causes a 20-second delay, confirming SQL injection. Tools like sqlmap can automate exploitation to enumerate the database or execute arbitrary SQL statements [4].

Impact

Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including user credentials, post content, and other stored data. The attacker can also modify database records, potentially escalating privileges or altering application behavior. The CVSS v3 base score is 7.1 (High), reflecting low attack complexity and network access [3].

Mitigation

The vendor has not released a patched version as of the publication date. The advisory indicates that versions 3.8.2 and earlier are affected [3]. Users should upgrade to a patched version if and when it becomes available, or restrict access to the admin.php endpoint and ensure that only trusted, authenticated users have accounts. No official mitigation or workaround has been provided in the available references.