RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection
90Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.8epss 12%
da publicação à arma
Publicada no NVD13 de jun.
VulnCheck+555d
probabilidade de exploração
12%top 4% das CVEs
exploração observada
simVulnCheck
1 exploit(s) público(s)
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2.
Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
davidfcarr · RSVPMakerPoCs públicas encontradas — 1
cve_referencepacketstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.htmlhttps://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cchttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cvehttps://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768