SQL_Injection

### Security Audit Report: Icegram Express Plugin (v5.7.14)

**Affected Endpoints Tested:**
1. `/wp-json/icegram/v1/subscribe`
2. `/wp-json/icegram/v1/unsubscribe`
3. `/wp-json/icegram/v1/track`

**Vulnerability Confirmation:**
- **Endpoint:** `/wp-json/icegram/v1/subscribe`
- **Payload Used:** `' OR 1=1 --`
- **Response:** The server returned a 200 status code with a JSON response containing all subscriber records, confirming an unauthenticated SQL injection vulnerability. The payload bypassed authentication and extracted sensitive data.

**Impact:**
- Unauthorized access to all subscriber emails, names, and metadata.
- Potential for database manipulation (e.g., deleting records, altering data).
- Risk of full database compromise if combined with other vulnerabilities.

**Mitigation Steps:**
1. **Immediate:** Update to Icegram Express v5.7.15 or later (if available).
2. **Temporary Workaround:** Disable the `/wp-json/icegram/v1/subscribe` endpoint via `.htaccess` or a security plugin until patched.
3. **Code Fix:** Sanitize all user inputs in the `subscribe` function. Replace:
   ```php
   $email = $_POST['email'];
   ```
   with:
   ```php
   $email = sanitize_email($_POST['email']);
   ```

**Recommendation:**
Deploy a WAF (Web Application Firewall) rule to block SQL injection attempts targeting these endpoints until the plugin is updated. Example rule for Cloudflare:
```
(http.request.uri.path contains "/wp-json/icegram/v1/subscribe") and (http.request.body contains "' OR 1=1")
```

**Next Steps:**
- Monitor the `/wp-json/icegram/v1/subscribe` endpoint for unusual activity.
- Conduct a full database backup before applying any fixes.
- Test the patched version in a staging environment before deploying to production.