CVE-2020-9006

🗓️ 17 Feb 2020 14:33:25Reported by mitreType

cve🔗 web.nvd.nist.gov👁 114 Views🌐 WEB

Popup Builder plugin 2.2.8 - 2.6.7.6 for WordPress SQL injection vulnerabilit

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for Deserialization of Untrusted Data in Sygnoos Popup_Builder	21 Jul 202005:39	–	githubexploit
CNVD	WordPress Popup Builder SQL Injection Vulnerability	18 Feb 202000:00	–	cnvd
CNVD	WordPress Popup Builder SQL Injection Vulnerability (CNVD-2020-13888)	24 Feb 202000:00	–	cnvd
Cvelist	CVE-2020-9006	17 Feb 202014:33	–	cvelist
NVD	CVE-2020-9006	17 Feb 202015:15	–	nvd
OpenVAS	WordPress Popup Builder Plugin 2.2.8 < 3.0 SQL Injection Vulnerability	25 Feb 202000:00	–	openvas
OSV	CVE-2020-9006	17 Feb 202015:15	–	osv
Patchstack	WordPress Popup Builder plugin <= 2.6.7.6 - SQL injection (SQLi) vulnerability	16 Feb 202000:00	–	patchstack
Prion	Sql injection	17 Feb 202015:15	–	prion
RedhatCVE	CVE-2020-9006	22 May 202517:35	–	redhatcve

NVD

Node

sygnoos popup_builderRange2.2.8–2.6.7.6wordpress

Source	Link
wpvulndb	www.wpvulndb.com/vulnerabilities/10073
zeroauth	www.zeroauth.ltd/blog/2020/02/16/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization/
plugins	www.plugins.trac.wordpress.org/browser/popup-builder/tags/2.2.8/files/sg_popup_ajax.php
wordpress	www.wordpress.org/plugins/popup-builder/

Parameter	Position	Path	Description	CWE
attachmentUrl	request body	wp-content/plugins/popup-builder/sg_popup_ajax.php	SQL injection via PHP deserialization in sg_importPopups using attacker-controlled data (attachmentUrl)	CWE-89, CWE-502

21 Nov 2024 05:39Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 3.19.8

EPSS0.41252