Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection

Vulnerability

The Secure Copy Content Protection and Content Locking WordPress plugin before version 2.8.2 fails to properly escape the sccp_id parameter in the ays_sccp_results_export_file AJAX action. This parameter is used directly in a SQL statement without sanitization, leading to a SQL injection vulnerability. The AJAX action is available to both unauthenticated and authenticated users, making the attack exploitable without any prior authentication [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the affected WordPress site targeting the ays_sccp_results_export_file AJAX action. The sccp_id parameter can be injected with malicious SQL payloads. No authentication or user interaction is required, and the attacker only needs network access to the WordPress instance [1]. Proof-of-concept code is publicly available [2].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the WordPress database. This could lead to the disclosure of sensitive data, including user credentials, password hashes, and other site content. The attacker could also potentially modify or delete data, depending on the database user's privileges [1].

Mitigation

The vulnerability is fixed in version 2.8.2 of the plugin, released on 2021-11-08 [1]. Users must update to version 2.8.2 or later. There is no known workaround other than immediately updating the plugin. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.