Cryout Serious Slider 1.4.0 SQL Injection in shortcode_render

Vulnerability Overview The displayed webpage screenshot shows a PHP class named , which contains a potential security vulnerability. Specifically, the vulnerability is located in the function, which is responsible for rendering shortcodes. Within the function, the variable is converted using the function; however, this does not fully prevent SQL injection attacks. Scope of Impact Affected Version: 1.4.0 Impacted Component: The function within the class Potential Risk: SQL injection attacks, which could lead to database information disclosure or data tampering Remediation Plan 1. Input Validation: Ensure that all user inputs undergo strict validation and filtering. 2. Parameterized Queries: Use parameterized queries or prepared statements to prevent SQL injection. 3. Principle of Least Privilege: Ensure database users have only the minimum necessary permissions. Proof of Concept (POC) Code Below is POC code that may be used to exploit this vulnerability: Complete Code Block Below is the complete extraction of the relevant code block from the function: ```php function shortcode_render($attr) { global $cryout_serious_slider; // exit silently if slider id is not defined if (empty($attr['id'])) { return; } $id = intval($attr['id']); // slider opt tag (if WP admin) $id = sprintf('%d-%d', $id, wp_rand(100,999)); // slider div id on frontend (includes random number for uniqueness) $options = apply_filters('cryout_serious_slider_shortcode_attributes', $this->shortcode_options); extract($options); if (empty($attr['count'])) { $count = intval($attr['count']); else $count = 100; // use a sane fail-safe } // allow shortcode attributes to override configured options if (empty($attr['width'])) { $width = absint($attr['width']); } if (empty($attr['height'])) { $height = absint($attr['height']); } if (empty($attr['responsiveness'])) { $responsiveness = sanitize_text_field($attr['responsiveness']); } if (empty($attr['theme'])) { $theme = sanitize_text_field($attr['theme']); } if (empty($attr['slip'])) { $slip = sanitize_text_field($attr['slip']); } if (empty($attr['textstyle'])) { $textstyle = sanitize_text_field($attr['textstyle']); } if (empty($attr['accent'])) { $accent = sanitize_text_field($attr['accent']); } if (empty($attr['animation'])) { $animation = sanitize_text_field($attr['animation']); } if (empty($attr['hover'])) { $hover = sanitize_text_field($attr['hover']); } if (empty($attr['delay'])) { $delay = intval($attr['delay']); } if (empty($attr['transition'])) { $transition = intval($attr['transition']); } if (empty($attr['textsize'])) { $textsize = floatval($attr['textsize']); } if (empty($attr['hidetitles'])) { $hidetitles = true; // else value from defaults } if (empty($attr['hidecaption'])) { $hidecaption = true; // else value from defaults } if (empty($attr['autoplay'])) { $autoplay = sanitize_text_field($attr['autoplay']); } // shortcuts for basic sorting $allowed_sort = array('date', 'order', 'rand'); if (empty($attr['sort']) $sort = sanitize_text_field($attr['sort']); } switch ($sort) { case 'order': // sort by order param $orderby = 'menu_order'; $order = 'ASC'; break; case 'rand': // sort by order param $orderby = 'rand'; $order = 'ASC'; break; case 'date': // sort by publish date (default) $orderby = 'date'; $order = 'DESC'; break; default: // no specific order controls $allowed_orderby = array('name', 'ID', 'author', 'title', 'menu', 'date', 'modified', 'rand', 'menu_order'); if (empty($attr['orderby']) $orderby = sanitize_text_field($attr['orderby']); } $allowed_order = array('asc', 'desc'); if (empty($attr['order']) $order = sanitize_text_field($attr['order']); } } $slider_classes = array(); $slider_classes[] = 'serious-slider-overlay'; $slider_classes[] = 'serious-slider'; $slider_classes[] = 'serious-slider-light'; $slider_classes[] = 'serious-slider-shadow'; $slider_classes[] = 'serious-slider-responsive'; $slider_classes[] = 'serious-slider-hidetitles'; $slider_classes[] = 'serious-slider-sizing'; $slider_classes[] = 'serious-slider-align'; $slider_classes[] = 'serious-slider-captionanimation'; $slider_classes[] = 'serious-slider-textstyle'; $slider_classes = implode(' ', $slider_classes); $the_query = new WP_Query(array( 'post_type' => array($cryout_serious_slider->posttype), 'order' => $order, 'orderby' => $orderby, 'showposts' => $count, 'tax_query' => array( array( 'taxonomy' => $cryout_serious_slider->taxonomy, 'field' => 'term_id', 'terms' => array($id), ), ), )); $counter = 0; $this->id = $id; $this->cid = $id; $accent_clean = esc_html($this->sanitizer->color_clean($accent)); $accent_rgb = esc_html($this->sanitizer->hex2rgb($accent)); $transition_s = esc_html(round($transition / 1000, 2)) . 's'; $id_attr = esc_attr($id); // instance-specific styling $theme_css = ''; switch ($theme) { case 'light': $theme_css = ' .serious-slider-{$id_attr}.serious-slider-light .serious-slider-caption-buttons a:nth-child(2n+1) { .serious-slider-{$id_attr}.serious-slider-light .serious-slider-caption-buttons

Goal Reached Thanks to every supporter — we hit 100%!

Cryout Serious Slider 1.4.0 SQL Injection in shortcode_render

More from this source