CVE-2023-3197: critical vulnerability in inspireui MStore API – Create Native Android &…
MStore API <= 4.0.1 - Unauthenticated SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.8epss 3.9%
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Related CVEs — inspireui MStore API – Create Native Android &…
In the same product, most dangerous first.
CVE-2023-2732CRITICALMStore API <= 3.9.2 - Authentication BypassEPSS 67.3%CVE-2023-2734CRITICALMStore API <= 3.9.1 - Authentication BypassEPSS 3.8%CVE-2023-3277CRITICALMStore API <= 4.10.7 - Unauthorized Account Access and Privilege EscalationEPSS 3.4%CVE-2020-36713CRITICALMStore API <= 2.1.5 - Authentication BypassEPSS 1.6%CVE-2023-2733CRITICALMStore API <= 3.9.0 - Authentication BypassEPSS 1.2%CVE-2024-8242MEDIUMMStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.8%