A critical vulnerability has been identified in the Multiple Shipping Address for WooCommerce plugin, a tool used by online shops to manage shipments to multiple destinations. This flaw could allow attackers to manipulate the site’s database without the need for authentication, exposing or altering sensitive information.

Technical Summary

In plugin versions prior to 2.0, several AJAX endpoint parameters were not correctly sanitized or escaped before being incorporated into SQL queries. Specifically, the action=ocwma_choice_address endpoint is vulnerable and accessible even to unauthenticated users. This opens the door to Unauthenticated SQL Injection (SQLi) attacks.

An attacker can craft a malicious POST request to /wp-admin/admin-ajax.php using a payload such as:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [target]
Content-Type: application/x-www-form-urlencoded

action=ocwma_choice_address&sid=3+AND+(SELECT+1946+FROM+(SELECT(SLEEP(7)))zsme)

This causes a 7-second delay in the backend, demonstrating the presence of a time-based blind SQL injection. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and receives a score of 8.6 (High) on the CVSS 3.1 scale, due to the lack of authentication, low complexity, and high impact on confidentiality, integrity, and availability.

Recommendations

• Update immediately: Upgrade the Multiple Shipping Address Woocommerce plugin to version 2.0 or later, in which the issue has been resolved.

• Restrict access: Temporarily disable AJAX actions for unauthenticated users, if possible.

• Monitoring and auditing: Check logs for anomalous activity on AJAX requests, particularly towards admin-ajax.php.

• Web Application Firewall (WAF): Enable or configure a WAF to detect and block SQL injection attempts.