Executive brief
Sliced Invoices is a WordPress plugin used by businesses to create and manage professional quotes and invoices. A security flaw in the plugin allows an authorized user, such as a staff member with low-level access, to execute unauthorized database commands. This could lead to the theft of sensitive customer data, financial records, or the unauthorized modification of invoice information.
Technical details
An authenticated SQL injection vulnerability exists in Sliced Invoices versions 3.8.2 and prior. The flaw is located within the 'post' parameter handled by the admin.php endpoint when the 'action' is set to 'duplicate_quote_invoice'. Due to improper neutralization of special elements in SQL commands (CWE-89), an attacker with at least low-level authenticated access can inject malicious SQL code. This can be used to perform time-based blind SQL injection to extract sensitive information from the WordPress database or modify existing records. A public exploit exists demonstrating the vulnerability using a sleep command.
Affected products
- Sliced Invoices Sliced Invoices <= 3.8.2
Timeline
- 2019-10-22: disclosed: Vulnerability discovered and exploit authored by Lucian Ioan Nitescu
- 2019-10-24: other: Exploit published on Exploit-DB
- 2026-06-15: advisory: NVD and VulnCheck published advisory details