LeagueManager SQL Injection Scanner

LeagueManager is a WordPress plugin designed for sports clubs and administrators to manage and display league data, including standings, schedules, and statistics. It supports multiple sports types and customizable structures, making it ideal for sports community websites and fan engagement platforms. The plugin simplifies the organization of dynamic sports data, allowing webmasters to efficiently present league information to their audience.

SQL Injection is a critical vulnerability that arises when user-supplied input is not properly sanitized before being used in SQL queries. In LeagueManager, this flaw occurs due to insufficient validation of data passed through AJAX actions, enabling attackers to manipulate database queries. This can lead to unauthorized data access, modification, or even complete database compromise.

The vulnerability specifically affects AJAX actions in LeagueManager versions up to 3.9.11, where unsanitized parameters are directly concatenated into SQL statements. Attackers can exploit these endpoints by crafting malicious input that alters the intended query logic, bypassing authentication or extracting sensitive information from the database.

If exploited, an attacker could retrieve confidential data such as user credentials, personal information, or league statistics. They might also modify or delete database records, leading to data integrity issues or service disruption. In severe cases, this could escalate to full server compromise, affecting all users and data managed by the plugin.