CVE-2022-1453 (PHP, published 2022-05-10T20:15Z)
Description: value: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/davidfcarr/rsvpmaker
Files changed:
README.txt
rsvpmaker-admin.php
rsvpmaker-api-endpoints.php
rsvpmaker-email.php
rsvpmaker-group-email.php
rsvpmaker-plugabble.php
rsvpmaker-stripe.php
rsvpmaker.php
Commit message: fixes for sql injection, card testing


Vulnerable code:
Tested up to: 5.9.2
Stable tag: 9.2.5
		$sked = get_template_sked( $request['post_id'] );
if(($send_confirmation ||!is_numeric($send_confirmation)) && empty($confirm_on_payment) )//if it hasn't been set to 0, send it
		'rsvpmaker_relay_log',
		'rsvpmaker_relay_log'
function rsvpmaker_relay_log() {
	$sql = "SELECT * from $wpdb->posts JOIN $wpdb->postmeta ON $wpdb->posts.ID = $wpdb->postmeta.post_id WHERE post_type='rsvpemail' AND meta_key LIKE 'rsvp%' ORDER BY ID DESC, meta_key LIMIT 0,500";
	foreach($results as $row) {
		printf('<p>%s<br><strong>%s</strong> %s</p>',$row->post_title,$row->meta_key,$row->meta_value);
	}	
}


	global $current_user;
		$output = sprintf( '<form action="%s" method="get">%s (%s): <input type="text" name="amount" value="%s"><br />%s<br /><textarea name="stripenote" cols="80" rows="2"></textarea><br /><input type="hidden" name="txid" value="%s"><button class="stripebutton">%s</button>%s</form>', $url, __( 'Amount', 'rsvpmaker' ), esc_attr( strtoupper( $vars['currency'] ) ), esc_attr( $vars['amount'] ), __('Note','rsvpmaker'), esc_attr( $idempotency_key ), __( 'Pay with Card' ), rsvpmaker_nonce('return') );
	$keys = get_rsvpmaker_stripe_keys();

Version: 9.2.5
	return '9.2.5';

Fixed code:
Tested up to: 5.9.3
Stable tag: 9.2.6
<h3><?php esc_html_e('Minimum Amount','rsvpmaker'); ?>:</h3>
<div><input type="text" name="payment_option[payment_minimum]" value="<?php if(isset($options["payment_minimum"])) {echo esc_attr($options["payment_minimum"]);} else echo '5.00';?>" size="5" /> <br /><em><?php _e('Prevents fraudulent uses such as $1 donations to test stolen cards','rsvpmaker'); ?></em>
</div>

relative_urls: false,
remove_script_host : false,
document_base_url : "'.site_url().'/",
		$sked = get_template_sked( intval($request['post_id']) );
if(($send_confirmation ||!is_numeric($send_confirmation)) && $rsvpdata['yesno'] && empty($confirm_on_payment) )//if it hasn't been set to 0, send it

		'rsvpmaker_relay_queue_monitor',
		'rsvpmaker_relay_queue_monitor'
function rsvpmaker_relay_queue_monitor () {
	do_action('rsvpmaker_relay_queue_monitor');
	$sql = "SELECT ID, post_title, wpt_postmeta.meta_key, wpt_postmeta.meta_value FROM `wpt_posts` JOIN wpt_postmeta on wpt_posts.ID = wpt_postmeta.post_id WHERE post_type='rsvpemail' AND (post_status='draft' OR post_status='publish') AND meta_key='rsvprelay_to' ORDER BY ID DESC";
	$was = 0;
	echo '<h1>In Queue</h2>';
	if(empty($results))
		echo '<p>none</p>';
	else
	foreach($results as $row)
	{
		if($row->ID != $was)
			printf('<h2>%s</h2>',$row->post_title);
		printf('<p>%s %s</p>',$row->meta_key, $row->meta_value);
		$was = $row->ID;
	}
	echo '<h1>Sent (200 Latest)</h2>';
	$sql = "SELECT ID, post_title, wpt_postmeta.meta_key, wpt_postmeta.meta_value FROM `wpt_posts` JOIN wpt_postmeta on wpt_posts.ID = wpt_postmeta.post_id WHERE post_type='rsvpemail' AND meta_key='rsvpmail_sent' ORDER BY ID DESC LIMIT 0, 200";
	$results = $wpdb->get_results($sql);
	$was = 0;
	foreach($results as $row)
	{
		if($row->ID != $was)
			printf('<h2>%s</h2>',$row->post_title);
		printf('<p>%s %s</p>',$row->meta_key, $row->meta_value);
		$was = $row->ID;
	}
}
				$rsvpdata['yesno'] = $yesno;
				
	global $current_user, $rsvp_options;
	global $rsvp_options;
		$output = sprintf( '<form action="%s" method="get">%s (%s, %s %s): <input type="text" name="amount" value="%s"><br />%s<br /><textarea name="stripenote" cols="80" rows="2"></textarea><br /><input type="hidden" name="txid" value="%s"><button class="stripebutton">%s</button>%s</form>', $url, __( 'Amount', 'rsvpmaker' ), esc_attr( strtoupper( $vars['currency'] ) ), __('minimum','rsvpmaker'), $rsvp_options['payment_minimum'], esc_attr( $vars['amount'] ), __('Note','rsvpmaker'), esc_attr( $idempotency_key ), __( 'Pay with Card' ), rsvpmaker_nonce('return') );
	$keys = get_rsvpmaker_stripe_keys();

	if($vars['amount'] < $rsvp_options['payment_minimum']) {
		do_action('rsvpmaker_possible_card_testing',$vars);
		return '<p>Transactions of less than '.$rsvp_options['payment_minimum'].' not accepted.</p>';
	}

Version: 9.2.6
	return '9.2.6';
		'payment_minimum'                   => '5.00',