CVE-2023-5203 WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injection

2023-12-2618:33:07

WPScan

www.cve.org

cve-2023-5203

wordpress plugin

sql injection

unauthenticated attacker

sensitive data

0.002 Low

EPSS

Percentile

51.7%

JSON

The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Sessions Time Monitoring Full Automatic",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "1.0.9"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/7f4f505b-2667-4e0f-9841-9c1cd0831932

0.002 Low

EPSS

Percentile

51.7%

JSON

Related for CVELIST:CVE-2023-5203