CVE-2017-20103 in Kama Click Counter Plugin
Summary
by MITRE • 06/28/2022
A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument order_by/order with the input ASC%2c(select*from(select(sleep(2)))a) leads to sql injection (Blind). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.9 is able to address this issue. It is recommended to upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/07/2026
This critical vulnerability in the Kama Click Counter Plugin represents a sophisticated blind sql injection flaw that exists within the wordpress administration interface at wp-admin/admin.php. The vulnerability stems from improper input validation and sanitization of the order_by/order parameters, which are processed without adequate security controls to prevent malicious payload injection. Attackers can exploit this weakness by crafting specifically formatted input strings containing time-based sql injection payloads that cause the database server to pause execution, thereby enabling the attacker to infer information about the underlying database structure through timing differences.
The technical implementation of this vulnerability leverages the universal sql injection attack pattern where the malicious input ASC%2c(select*from(select(sleep(2)))a) is processed by the application's query construction logic. When executed, this payload forces the mysql database to perform a sleep operation, creating a time delay that can be measured by the attacker to confirm successful injection and extract data through blind sql injection techniques. The vulnerability operates at the application layer, specifically within the wordpress admin dashboard context where administrative functions are processed, making it particularly dangerous as it could potentially allow attackers to escalate privileges or extract sensitive user information.
The operational impact of this vulnerability is severe given its remote exploitability and the fact that the attack vector can be initiated through web-based interactions without requiring physical access or elevated privileges. The blind sql injection technique allows for information disclosure attacks where an attacker can systematically extract database contents through time-based timing attacks, potentially leading to full database compromise. This vulnerability directly relates to common weakness enumeration cwes 89 and 74, which specifically address sql injection vulnerabilities in web applications. The attack may be automated using standard penetration testing frameworks and could be exploited by threat actors targeting wordpress installations with vulnerable kama click counter plugin versions.
Security mitigation requires immediate upgrading to version 3.4.9 or later, as this release contains the necessary patches to address the input validation issues that enable the sql injection attack. Organizations should also implement additional protective measures including web application firewalls that can detect and block malicious sql injection patterns, input sanitization at multiple layers of the application architecture, and comprehensive monitoring for suspicious database query patterns. The vulnerability demonstrates the importance of proper parameterized queries and input validation practices as recommended by the mitre attack framework's techniques for credential access and defense evasion. Regular security assessments and automated vulnerability scanning should be implemented to identify similar injection vulnerabilities in other wordpress plugins and themes that may be running on the same infrastructure.